pihole-dot-upstream-failoverlisted

# Pi-hole DoT upstream resolvers: tool choice, config gotchas, and failover design ## `cloudflared proxy-dns` is the wrong tool — don't reach for it `cloudflared proxy-dns` was deprecated by Cloudflare in November 2025; Cloudflare stopped shipping it in new `cloudflared` releases as of February 2026 (confirmed via Pi-hole's own docs, which now carry an explicit deprecation warning on the guide). Existing installs kept working for roughly 12 months post-deprecation, but it's not safe to stand up fresh. Independent of the deprecation: `cloudflared proxy-dns`'s `--upstream` flag only ever supported DoH endpoints (`https://1.1.1.1/dns-query`), **never DoT** (`tls://`). If the goal is specifically DoT (not DoH), this tool was never the right choice, at any point in its history. **Use `stubby` instead** — a purpose-built DoT stub resolver, packaged directly in Debian's own apt repo (confirmed: `stubby` 1.6.0-3.2 on Debian 13/trixie, no third-party repo or GPG key needed). It's the standard community pattern for "forward only to a specific DoT upstream." ## stubby config gotchas - **Packaged default listens on `127.0.0.1:53`** (and `::1:53`) — will silently coexist with a wildcard `0.0.0.0:53` bind from something else (e.g. pihole-FTL) on Linux, since a more-specific bind doesn't conflict with a wildcard one. This is a coincidence of bind ordering, not something to rely on — always pin an explicit non-conflicting port. - **Port syntax on `listen_addresses` is `IP@port`**