Pi-hole on its own does not encrypt the DNS traffic to the upstream servers. To ensure the traffic is encrypted we use Unbound. Unbound is a recursive DNS server with caching.