[tristor]

> but what if you don't trust anyone and want to run your own TRR?

You can do that today. Run your own DNS server w/ DoH as an endpoint (dnscrypt-proxy provides an avenue, you can also use nginx to do this). Then have enterprise policies on your network to point DoH clients to use this resolver.

[firebird84]

The problem is if your TRR can be associated with you, then outgoing queries to authoritative servers can be tracked.