Yeah like kwss said, it's free, I have my own home server on a thin client that hosts a few services such as Home Assistant, Adguard Home, some docker containers and stuff. Just pay for the electricity. I can also use the VPS that hosts my static website but for the time being I prefer to use my home server.

I also have a VPN already but I don't connect to VPN all the time because some sites/games need me to turn off VPN. But the primary reason I set up Adguard Home is to block ads and stuff. The DNS stuff is an after thought and just happened to integrate quite well.

I think since he already has a domain, he must also have something already running. So the cost is free. It is just additional path configuration in nginx and whatever software behind the scene.

Even if you do not have a domain, do not have any cloud instance, you can still create a CloudFront Distribution and Amazon will assign you something like dxxxxxxxxxxxxx.cloudfront.net.
1TB egress per month is free. USD $0.02/GB for origin request. Let's say you use 5GB of DNS request traffic per month, it is only USD $0.10 per month. I never heard of any home user with 5GB per month of DNS request. DNS response is free and covered under 1TB quota.

I think the free 10 millions request per month is more than enough for DNS requests.

DNS wall climbing for beginner
This quick guide will teach you how to use CDN to front DoH server using Amazon CloudFront.
The benefit this provides over other method is the difficulty of the censor to block this kind of setup without blocking the whole CDN provider.

Requirements:
AWS Account
Browser / OS / resolver supporting DoH

Just want to ask. Isn't this illegal or against the ToS of these cloud service providers? I've heard of domain fronting before and I thought it was mostly restricted. Or is that a different thing altogether?

They can implement a blanket block on both DoT and DoH for public DNS if they want. But for now, DoT works.

If they enforce a strict block, just get a cloud instance in SG for $5 a month and VPN everything there.

if it's discovered / reported you just get a ban
then proceed to created another new account for the same thing

I still think the risk that you can get banned for domain fronting should be highlighted in the guide since you need to input credit card info, real name/address, etc. to register for AWS.

I still think the risk that you can get banned for domain fronting should be highlighted in the guide since you need to input credit card info, real name/address, etc. to register for AWS.

This is not domain fronting as i do not spoof SNI anywhere. The SNI and Host header are the same throughout the connection.

All CDN already blocked domain fronting.

I thought you're using VPS + domain coz you mention about unbound, and if i'm not mistaken unbound is actually unencrypted so the ISP still can eavesdrop your unbound queries unless you setup your unbound in foreign country VPS and then DoH back to your devices.

Thanks for your tutorials above, it really help me a lot. 
I'll try to set it up.

Asus brand better then TP-Link ? I remember back old days using Asus Router very fast spoiled

Hey all, I need to ask about applying new unifi line.

Can I apply for new installation from another state? Let's say I'm in Sabah working but would like to apply unifi from TM point at another home in Johor.

Appreciate feedback on this.

Can I apply for new installation from another state? Let's say I'm in Sabah working but would like to apply unifi from TM point at another home in Johor.

need login into router using admin password