Look at reverse proxy instead. While you can do what you're after with DNS, a bunch of the reverse proxy systems will automatically deal with SSL certificate, and there are even a couple that eliminate essentially all configuration outside of your docker file. Like, add a new docker and it automatically configures appName.domain.tld with SSL assigned. And if you ever decide to expose that address to the Internet, reverse proxy makes that simple and provides some security options as well.

I use Caddy for my reverse proxy running from my OPNsense firewall, but if you want the automation with docker there are better options.

Unbound on my OPNsense firewall. I don't have advice for you, do you have some specific goals besides just having a DNS?

Whenever you do get it clean, treat it with RainX or similar. We do that every few years and squeegee after each shower, our glass is spotless after 10 years. Our water is super hard too, saw the house next to ours which was built at the same time, disgustingly opaque with scale.