A cheap "Android Private DNS" for systemd-resolved and NetworkManager. Resolves your DoT host and then sets it via resolvectl. Triggered by NM-dispatcher "up" action.

12-dns-dot-resolved.sh

#!/usr/bin/env bash

# dns host to connect over DoT to
DNS_HOST="example.host.com"

INTERFACE="$1"
case $NM_DISPATCHER_ACTION in
	# set dns
	up)
		# wait for connection to be fully up (e.g. NM configuring resolved)
		# TODO: find better method than sleeping
		sleep 5

		# resolve hosts IPs
		# TODO: resolve multiple ips by grepping RAW field
		IP4="$(getent ahostsv4 $DNS_HOST | tail -1 | awk '{ print $1 }' )"
		IP6="$(getent ahostsv6 $DNS_HOST | tail -1 | awk '{ print $1 }' )"
		
		# gen hosts strings
		[[ ! -z "$IP4" ]] && HOSTS="${HOSTS# } $IP4:853#$DNS_HOST"
		[[ ! -z "$IP6" ]] && HOSTS="${HOSTS# } [$IP6]:853#$DNS_HOST"
		
		# if no hosts exit
		[[ -z "$HOSTS" ]] && exit
		
		# set DoT server in systemd-resolved
		echo "Setting DNS to $HOSTS for $INTERFACE"
		resolvectl dns $INTERFACE $HOSTS
		echo "Enabling DoT for $INTERFACE"
		resolvectl dnsovertls $INTERFACE yes
		;;
	# reset dns (should happen anyways but just to be sure)
	down)
		echo "Resetting DNS for $INTERFACE"
		resolvectl revert $INTERFACE
		;;
esac