policy.TLS_FORWARD to a random upstream DNS service provider

kresd.conf

math.randomseed(os.time())
tls_ca_bundle = '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem'

dns_providers = {
  {
    {'9.9.9.9', hostname='dns.quad9.net', ca_file=tls_ca_bundle},
    {'2620:fe::fe', hostname='dns.quad9.net', ca_file=tls_ca_bundle},
    {'149.112.112.112', hostname='dns.quad9.net', ca_file=tls_ca_bundle}
  },
  {
    {'1.1.1.1', hostname='cloudflare-dns.com', ca_file=tls_ca_bundle},
    {'2606:4700:4700::1111', hostname='cloudflare-dns.com', ca_file=tls_ca_bundle},
    {'1.0.0.1', hostname='cloudflare-dns.com', ca_file=tls_ca_bundle},
    {'2606:4700:4700::1001', hostname='cloudflare-dns.com', ca_file=tls_ca_bundle}
  }
}

policy.add(policy.all(policy.TLS_FORWARD(dns_providers[math.random(#dns_providers)])))