pfSense

+ upvote for this!

Using DoT/DoH already are the standard nowadays (at the first because most used browsers Safari, Chrome and Firefox PUSHING users to use DoT/DoH by default as a result of rapidly growing numbers of hacker attacks on the DNS services exactly!).

pfSense as one of the leaderships in industry MUST implementing flawlessly using DoH/DoT also for INTERNAL LANS.

Please reference:
https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2471956/nsa-recommends-how-enterprises-can-securely-adopt-encrypted-dns/

“NSA recommends that an enterprise network’s DNS traffic, encrypted or not, be sent only to the designated enterprise DNS resolver.”
Building on that guidance, there should ideally be an RFC or standardized mechanism for locking down browsers and operating systems so they can use only approved DoH servers. With such controls in place, clients could be configured to direct all DNS queries to a local resolver (such as pfSense Unbound), while the firewall enforces that any DNS-over-HTTPS traffic is forwarded exclusively to an authorized upstream resolver. This would re-establish enterprise DNS security controls, especially given prior incidents where attackers have abused DoH for command-and-control purposes.