You can insert dnscrypt-proxy inline between PiHole and an upstream server. So it'll work something like the following:

Client --DNS--> pinhole --DNS--> dnscrypt-proxy (localhost) --DoH--> upstream

Not the prettiest but it works.

I’m not sure why I’d ever want DoH, I block as much as I can at my firewall and have a canary domain.

I want my devices to use my defined dns sever on my network, not some ad company (and all tech companies eventually become ad companies)

I want pihole to talk encrypted to the upstream dns server. I don't actually care if my devices talk encrypted to pihole.

I just don't want to leak dns requests to my isp. If there's a way to do this without DoH or DoT, I'd happily learn more about it.

DoT has a standard port, meaning blocking (conforming) requests simple. DoH uses 443.

Nothing says clients need to confirm to the port requirements, but most companies will be lazy and assume 853 will work.

Speaking of not wanting DoH to exist on the local network, does anyone know if there is anything pre-existing that can hook into firewall rules to default deny outgoing traffic and only allow (until TTL expiry) in response to a DNS lookup? That way things cannot bypass your DNS filtering with DoH or hardcoded IPs.

IIRC, there is not a native GUI method for Pihole to talk encrypted to DoH providers. You have to set up a daemon locally and configure via CLI, then set that as your "upstream" DNS provider in Pihole admin.

Obviously the goal is to have your local clients talking to Pihole, but the goal of having remote DNS queries encrypted is to prevent ISP snooping.

Though if you really want to prevent ISP snooping you have all clients using VPN or configure your router to send all outbound traffic to a VPN endpoint.

People use DoH/DoT so that their upstream DNS lookups are not transmitted in plaintext across the open internet. You can do this and still run your own DNS server on your network. The parent commenter is asking about Pihole with DoH, which is exactly this.

DoT sure. The whole “tunnel everything over http” is a terrible pattern

Hostile firewalls that block and/or intercept DNS traffic are also a bad pattern, but people don't always control their local network these days. You can't always count on 853 being open. There are valid use cases for both.

its far easier to control your network than it is to control your devices on that network - far too many closed source devices nowadays, and it’s extremely difficult to avoid all of them

Maybe that is true about your devices, and your use cases, on your home network, but that is far from the only use case in the world.

I've been using https://github.com/DNSCrypt/doh-server for serving my DNS server via DOH for at least 2 years. Only had two issues with it and both were due to lack of maintenance on my part (ie. not updating the binary for one and then not re-configuring it after I changed configurations for the upstream DNS).

Assuming doh = dns over http

Yes