Once upon a time, I used a background helper to workaround the problem of captive portals by temporarily disabling dnscrypt-proxy dns settings when connecting to Wi-Fi on public networks. If it couldn't reach Apple's www.thinkdifferent.us with the correct content, then it should temporarily disable dnscrypt and show a notification. When it switched back, it would also show a notification. dnscrypt and tor also don't play well with anycast-dependent services like software updates.

I've tried managing wired and wireless interface switching on macOS without luck, and gave up on switching.

At home, I skipped dnscrypt and run unbound on the firewall with DoT upstreams and direct all clients to use it.