fritz.box for the machines themselves because Fritz!BOX (although handed out by Pi-Hole),but .lan for anything going over the local proxy towards the same machine for TLS.
Some machines use my custom domain name instead of .lan, if they need to be accessible from outside. So these last ones go directly over the local proxy internally, but automatically over CloudFlare Tunnel and Authentik when not at home. The proxy being Caddy.
Nice, but you don't need this per se. If you have two Piholes doing DNS, one of them can do DHCP and push the two pihole DNS server addresses. If the one with DHCP goes down temporarily you will not get a new addresses, but DNS resolution continues one the one running.