Thanks to Unbound, the built-in DNS resolver, which has been enabled by default since pfSense version 2.3, makes configuring DNS over TLS a very simple task with pfSense.