DoH ready:
  - /dns-query       (pass-through)
  - /dns-query-ecs   (adds ECS 8.8.8.0/24)