Your suggestion looks similar to this other comment and makes sense. I'll try that!
I have never managed to wrap my head around DoH and DoT but this is on my todo list ^^
I didn't know dnsmasq has an adblock plugin, I'll have a look. Originally, I was using dnsmasq alone (running on bare metal). Then I migrated to docker and added pi-hole for ad blocking. I tried to get rid of dnsmasq but pi-hole's embedded DHCP is not as configurable as dnsmasq's and I could not address my use case.