DNS: nsd or tinydns
listens on 127.8.8.1
query example.com @127.8.8.1
custom root.zone with wildcards
answer example.com IN A 127.8.8.2
Proxy: haproxy
listens on 127.8.8.2, returns user-provided certificate
replaces URLs, etc.
forwards to 93.184.216.34, verifies server certificate
To generate certificates, I wrote a "mkcert" script years before the one written in Go that is now being promoted by someone working for Google. That company's web browser has the majority share of users. Alas, that browser is unreasonably hostile to user-provided certificates for local addresses.1 Hence this is probably not a setup that is appropriate for everyone or every situation. For recreational web use, I like to manipulate and inspect traffic, this is more lightweight than popular alternatives (mitmproxy, etc.), so it works for me.
1. https://stackoverflow.com/questions/7580508/getting-chrome-t...
If I were to make a "Pi-Hole", I would use nsd, tinydns and haproxy. There would be no need for third party DNS. For anyone that wanted to use third party DNS, optionally I would provide dnscache. It's easy to take public DNS blocklists and "import"^1 them into dnscache.
There are lots of other interesting "alternative Pi-Hole" ideas yet to be tried.
1. dnscache uses the filesystem for nameserver manipulation instead of lists. Each domain is a file in the root/servers folder. Each file contains the address of a (blackhole) nameserver.