I installed doh-client from https://github.com/m13253/dns-over-https onto my EdgeOS router, then pointed dnsmasq at doh-client and, well, it works and I have nothing else exciting to report. One less thing for AT&T to snoop.