> *Third, I set my recursive resolver to use the nextdns.io endpoint as its upst...

> Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS.

Doesn't that relegate your recursive resolver to a stub?

You could run pi-hole on fly.io for free if DoT/DoH is all you need: https://fly.io/blog/stuff-your-pi-hole-from-anywhere/

I run a public DoH resolver with 170+ blocklists on Cloudflare Workers. Might open source it soon.