RouterOS, as of 7.24, still has no proper HTTP/2 support for the built-in DoH client. It appears not to make use of multiplexing and instead opens many parallel connections, similar to HTTP/1.
Initial DoH HTTP/2 support was added in 7.23, but only for ARM64, x86, and CHR. It will also take some time before 7.23 reaches the long-term channel. And when will it be available for ARM?
In my opinion, DoH has already been largely superseded by DNS over QUIC (DoQ). In my own (simple) testing, DoQ responses were slightly faster than DoH, although your results may vary.
Unfortunately, DoQ support in RouterOS does not seem to be on the horizon anytime soon, while the built-in DoH implementation still has some limitations.
An alternative I have been using for roughly the past year is dnsproxy by AdGuardTeam. It can be run on RouterOS using a container image. It is also quite memory efficient. On my setup the container memory-current is reported as ~5,6MiB after startup and stays < 10MiB during longer uptime (so no memory leaks here).
Okay, let's go. I will not cover the basic RouterOS container setup here. Just some examples.
For example, using Quad9 with DoQ:
/container/add remote-image=adguard/dnsproxy cmd="-u quic://dns.quad9.net:853 -b 9.9.9.9:53" interface=<your-existing-veth> start-on-boot=yes
If you prefer DoH, with HTTP/3 enabled:
/container/add remote-image=adguard/dnsproxy cmd="-u https://dns.quad9.net/dns-query --http3 -b 9.9.9.9:53" interface=<your-existing-veth> start-on-boot=yes
-b 9.9.9.9 is only used for bootstrap, to perform the initial DNS resolution of dns.quad9.net. By default dnsproxy would try the system resolver - but this would lead to a loop once the system resolver is set to use dnsproxy.
Check the container logs, and once everything is running correctly, configure the container as the global DNS server:
/ip/dns/set servers=<your-veth-ip>
Done, basically. You can verify this under "IP/IPv6 > Firewall > Connections". When using DoQ, you should see a single persistent connection to dst-port 853 originating from the container IP (besides the already time-outing connection to 9.9.9.9:53).
PS:
dnsproxy also has a built-in caching mechanism. I do not use it, I simply rely on the RouterOS cache.
PS2:
I am not affiliated with AdGuardTeam or Quad9. I personally use NextDNS, but chose Quad9 for this example because it is a European-based resolver with a strong focus on privacy.