I'd argue you don't need to run DoT/DoH yourself if it is just for your local network.

Setting up a local resolver, such as a Pi-Hole or Unbound on a firewall can serve unencrypted responses to your devices. Those resolvers in turn can use DoT/DoH with their upstream resolvers to encrypt the requests that go through untrusted networks on the Internet.

This is the best of both worlds, the simplicity of unencrypted DNS while encrypting traffic where it matters.