Here is an example using TLS:

    forward-zone:
      name: "."
      forward-ssl-upstream: yes
      forward-addr: 208.67.222.222@853
      forward-addr: 1.1.1.1@853
      forward-addr: 8.8.4.4@853
      forward-addr: 9.9.9.9@853
      forward-first: no

    unbound-control dump_infra|cut -c 1-60|column -t
      9.9.9.9@853         .  ttl  851  ping  6    var  84    rtt  342   rto  342  tA  0  tAA
      8.8.4.4@853         .  ttl  851  ping  13   var  79    rtt  329   rto  329  tA  0  tA
      208.67.222.222@853  .  ttl  844  ping  876  var  1823  rtt  8168  rto

And here [1] [2] are a small list of public servers that support DoT

[1] - https://en.wikipedia.org/wiki/Public_recursive_name_server

[2] - https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Public+Re...