Sadly, this is probably enough to get me to switch from OpenDNS to Cloudflare Teams.
Not that this is much threat to OpenDNS, as a free customer, it's not like I'm taking any "business".
I *could* use an additional proxy to get the local request queued into DoH, but DNS lookups are already stupid slow compared to what they would be running a purely local resolver. If I want to use a local resolver to block more ads than OpenDNS (not to mention saving ISP traffic from any queries blocked locally...), then I have to run something locally. Ph-hole, or as the OP, unbound, there's other similar choices. I could even run DNSmasq in my router. Whatever method I use, however, requires an extra step. Pi-hole would require an extra step to use DoH *or* DoT, and most of the other choices would be similar:
client -> pi-hole -> DNSCrypt -> OpenDNS
or
client -> pi-hole -> Unbound -> OpenDNS
If I instead run unbound, I can use DoT directly, and unbound runs well on the same hardware as pi-hole, so I can skip a layer:
client -> Unbound -> OpenDNS
...except that OpenDNS, for no good reason, refuses to support DoT.
I would prefer to stick with OpenDNS, I think it's a better product, and with API support for changing your registered external IP address, it solves problems Cloudflare hasn't yet, but I also don't want my ISP to be able to see my DNS traffic.
Unbound *appears* to support DoH upstream, but the config examples seem to indicate that you need the certificate file from the other end in order for unbound to trust it. If anyone has experience with this configuration, I'd love to hear from you, since I can't seem to find anything on Google about it.
