Adding of DNS over TLS

Can you add DNS over TLS?

not expert on this side, @filippo_carletti could help I suppose

Reading this

My understanding is the main dns server is dnsmasq but when the email server is installed then we use too unbound for the antispam.

How interacts unbound and dnsmasq. Do they work at the same level and do queries to the external dns name resolvers or do unbound uses dnsmasq as a relay and store for the antispam the needed information ?

Why does nethserver use dnsmasq AND unbound anyway? Because of DHCP and PXE?

DNSSEC and DNS over TLS should be possible. So how can this be done?