Controld

[listener]
  [listener.0]
    ip = '0.0.0.0'
    port = 53

    [listener.0.policy]
      name = 'My Policy'
      rules = [
        {        '*.local' = ['upstream.1']},
        {        '*.customdomain.com' = ['upstream.1', 'upstream.0']},
        {        'captive.apple.com' = []},
        {        'aircanadawifi.com' = []},
        {        'acwifi.com' = []},
        {        'gogoinflight.com' = []},
        {        'southwestwifi.com' = []},
        {        'singaporeair-krisworld.com' = []},
        {        'airborne.gogoinflight.com' = []},
        {        'aainflight.com' = []},
        {        'aa.viasat.com' = []},
        {        'deltawifi.com' = []},
        {        'wifi.delta.com' = []},
        {        'unitedwifi.com' = []},
        {        'shop.ba.com' = []},
        {        'alaskawifi.com' = []},
        {        'flyfi.com' = []},
        {        'wifi.airasia.com' = []},
        {        'wifi.sncf' = []},
        {        'wifi.tgv-lyria.com' = []},
        {        'freewlan.sbb.ch' = []},
        {        'register.onboard.eurostar.com' = []},
        {        'thalysnet.com' = []},
        {        'iceportal.de' = []},
        {        'vvm.mstore.msg.t-mobile.com' = []},
        {        'wifi.inflightinternet.com' = []},
        {        'captive.inflightinternet.com' = []},
        {        'airbornesecure.inflightinternet.com' = []},
        {        'ip.videotron.ca' = []},
        {        'wifi.united.com' = []},
        {        'etihadwi-fly.com' = []},
        {        'inflight-wifi.com' = []},
        {        'southwestwifi.com' = []},
        {        'wifi.cathaypacific.com' = []},
        {        'timhortonswifi.com' = []},
        {        'detectportal.firefox.com' = []},
        {        'portal.mist.com' = []},
        {        'wifi.connected.xfinity.com' = []},
        {        'vvm.ee.co.uk' = []},
        {        'wifi.tgvlyria.com' = []},
        {        'guestinternet.com' = []},
        {        '*.network-auth.com' = []},
        {        'secure.datavalet.io' = []},
        {        'login.cloud5.com' = []},
        {        'wirelessportal.americanexpress.com' = []},
        {        '*.globalreachtech.com' = []},
        {        'neverssl.com' = []}
      ]

[network]
  [network.0]
    name = 'Network 0'
    cidrs = ['0.0.0.0/0']

[upstream]
  [upstream.0]
    type = 'doh'
    endpoint = 'https://dns.controld.com/SERVICE-ID'
    bootstrap_ip = 'X.X.X.X'
    timeout = 5000

  [upstream.1]
    name = 'OPNSENSE'
    type = 'legacy'
    endpoint = '192.168.0.1:53'