Just throwing out a couple of other solutions I didn’t see mentioned for DoH/DoT:
CoreDNS
Blocky
Both of those support encryption and allow for DNSBL. If you are wanting to hand out DNS entries over DHCP it may a problem with your ISPs router there. Either replace it, sit one you do control between it and your network, or run DHCP snooping from a switch to restrict it’s DHCP.