fightforlife

An Idea I am also using for other things where I do not want to use a VPN:

1. Setup a reverse proxy (e.g. traefik)
2. Setup an oauth middleware for everything (forward Auth)
3. Create rules to exempt very specific request based on IP, headers, etc… from the middleware.

In the casting use case you have to find a request and check if there is any parameter that you can use to safely whitelist the request. Ofcourse someone could get behind this and fake the request to match the whitelist. But without knowing that there is even a whitelist no one will really try

The feature list sounds even better than adguard home. I might give this a try!

But I never found a phone were I can manually enter a full DoH address in the system settings. It only allows you to enter a hostname, and this will always use DoT. I am not sure if DoH is really usable systemwide.