[yegle]

I believe Debian Burster (released just today) uses stubby (https://dnsprivacy.org/wiki/m/mobile.action#page/1277989) as system level DNS cache instead dnsmasq. Stubby support sending DNS-over-TLS query to upstream DNS.