Unbound using DNS over TCP:

server:
private-domain: "plex.direct"
forward-zone:
  name: "."
  forward-ssl-upstream: yes
  forward-addr: 1.1.1.1@853
  forward-addr: 9.9.9.9@853
  forward-addr: 1.0.0.1@853
  forward-addr: 149.112.112.112@853
  forward-addr: 2606:4700:4700::1111@853
  forward-addr: 2606:4700:4700::1001@853
  forward-addr: 2620:fe::fe@853;
  forward-addr: 2620:fe::9@853;

To test do:

# unbound-control -c /var/unbound/unbound.conf lookup .

It should return something like:

The following name servers are used for lookup of .
forwarding request:
Delegation with 0 names, of which 0 can be examined to query further addresses.
It provides 8 IP addresses.
1.1.1.1                 rto 401 msec, ttl 880, ping 33 var 92 rtt 401, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.
9.9.9.9                 not in infra cache.
1.0.0.1                 rto 397 msec, ttl 899, ping 13 var 96 rtt 397, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.
149.112.112.112         rto 418 msec, ttl 880, ping 58 var 90 rtt 418, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.
2606:4700:4700::1111    rto 376 msec, ttl 880, ping 0 var 94 rtt 376, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.
2606:4700:4700::1001    rto 376 msec, ttl 888, ping 0 var 94 rtt 376, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.
2620:fe::fe             rto 376 msec, ttl 884, ping 0 var 94 rtt 376, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.
2620:fe::9              rto 376 msec, ttl 899, ping 0 var 94 rtt 376, tA 0, tAAAA 0, tother 0, EDNS 0 assumed.