With Android 16 and later, you can use DoH natively OS-wide if the provider support DDR

DDR is a standard to allow the discovery of encrypted endpoints when an IP or hostname of the provider is given. For whatever reason, Android 16 and later support this, but the support for arbitrary providers is hidden behind two flags you can toggle with ADB https://github.com/eyalm2000/loophole#enable-the-flags

Why does it matter? Because in the Private DNS menu, while you can only enter a domain that, in turn, uses DoT by default, if the domain has a DDR record pointing to DoH, it can then use DoH natively. Great if you're in a network that blocks the DoT port entirely and don't want to use pseudo-VPN apps.

Currently, NextDNS doesn't directly provide the DDR record (eg, if your DoT profile domain is abc123.nextdns.io, there's no _dns.abc123.nextdns.io SVCB record to your DoH address), but if you have a domain (nic.ua provides pp.ua domain for free if you don't want to buy cheap .top or .xyz) in Cloudflare, you can then use the free Worker tiers (100k requests per day) to redirect to your DoH address, the details are in the linked GitHub repo above.

Someone in Reddit figured out that currently Android DDR support only handle DDR record pointing to DoH with `/dns-query` path, so if you try pointing directly to your, eg, dns.nextdns.io/abc123 that might not work.