That’s why I also block all known DoH IPs. It’s a pretty long list, like 130 IPs. I have an allowlist for devices I don’t want to mess with, like my Pihole or guest devices.

It’s definitely not perfect, but it does de job for now.