This is a blog post that I have wanted to make recently, after finding very little information online about how DNS over TLS (DoT) requests are formatted. What I have learnt while researching for my project is that DoT requests/respones only differ from normal DNS requests in one manner.
This difference is that the first 2 bytes of the message are the length of the rest of the message. These two length bytes are prepended to the message which is then sent with TLS. This is mentioned in the RFC, as seen here, but I didnt see this at first, leading to some errors. I hope this information is useful or atleast interesting to someone out there.