That's why I'm not a fan of DoH or certificate pinning. Those are tools of control.
replyI have my router set with iptables rules to block/redirect all port 53 and you can also add known DoH to a blocklist to try and force LAN devices to use your router DNS.
replyI have a separate lan for untrusted devices, I only use whitelisting. No public DNS for these devices.
reply