DNS over TLS appears to stop working once DNSSEC is enabled

Ah; likely a false report (false negative?) from https://1.1.1.1/help. The same behaviour has been noted here.