nginx-dot-to-dot-routing.conf

user  nginx;
worker_processes  auto;

load_module modules/ngx_stream_js_module.so;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

# DNS Stream Services
stream {

  # DNS logging
  log_format  dns   '$remote_addr [$time_local] $protocol "$dns_qname" "$upstream_pool"';
  access_log /var/log/nginx/dns-access.log dns;

  # Import the NJS module
  js_import /etc/nginx/njs.d/dns/dns.js;

  # The $dns_qname variable will be populated by preread calls, and used for DNS routing
  js_set $dns_qname dns.get_qname;

  # When doing DNS routing, use $dns_qname to map the questions to the upstream pools.
  map $dns_qname $upstream_pool {
    hostnames;
    *.nginx dnsmasq;
    *.k8s dnsmasq;
    default google;
  }

  # upstream pools (google DoT)
  upstream google {
    zone dns 64k;
    server 8.8.8.8:853;
  }

  # upstream pools (another DoT)
  upstream dnsmasq {
    zone dns 64k;
    server 192.168.64.1:853;
  }

  # DNS(TCP) and DNS over TLS (DoT) Server
  # Upstream can be either DNS(TCP) or DoT. If upstream is DNS, proxy_ssl should be off.
  server {
    listen 53;
    listen 853 ssl;
    ssl_certificate /etc/nginx/ssl/certs/doh.local.pem;
    ssl_certificate_key /etc/nginx/ssl/private/doh.local.pem;
    js_preread dns.preread_dns_request;
    proxy_ssl on;
    proxy_pass $upstream_pool;
  }

}