2) I believe you can using profiles like those available here[0].

[0]: https://github.com/paulmillr/encrypted-dns