[sneak]

You’re better off using a DoH client like unbound and pointing it at a nextdns.io upstream.

dnsmasq simply isn’t very good.