Stubby

/etc/stubby/stubby.yml

resolution_type: GETDNS_RESOLUTION_STUB
dns_transport_list:
  - GETDNS_TRANSPORT_TLS
tls_authentication: GETDNS_AUTHENTICATION_REQUIRED
tls_query_padding_blocksize: 256
edns_client_subnet_private : 1
idle_timeout: 10000
listen_addresses:
  - 127.0.0.1@8053
  - 0::1@8053
round_robin_upstreams: 1
upstream_recursive_servers:
  - address_data: 208.67.222.222
    tls_auth_name: "dns.opendns.com"
  - address_data: 208.67.220.220
    tls_auth_name: "dns.opendns.com"

systemd-resolved

/etc/systemd/resolved.conf

[Resolve]
DNS=208.67.222.222#dns.opendns.com
FallbackDNS=208.67.220.220#dns.opendns.com
DNSSEC=no
DNSOverTLS=yes

dnsmasq

/etc/dnsmasq.d/stubby.conf

no-resolv
server=::1#8053
server=127.0.0.1#8053
interface=wg0
except-interface=lo
bind-dynamic

/etc/dnsmasq.d/systemd-resolved.conf

no-resolv
server=127.0.0.53
interface=wg0
except-interface=lo
bind-dynamic

Enable Services

systemctl enable stubby
systemctl enable systemd-resolved
systemctl enable dnsmasq