[growse]

> Unless that code is malware or some Javascript an advertiser has placed on a website. There is no way to stop software from doing its own DoH requests without using browser or OS services to do it, so the controls supplied by the browser or OS are of rather limited value.

This is true irrespective of DoH. If software wants to ignore the OS settings and resolve names down via its own custom protocol, that's what it's going to do. Short of auditing that software and it's connections, you can't really stop it.

The OS settings are not a control, they're a convenience.

[JohnFen]

True. DoH just makes it much cheaper and easier to do in a robust way. Which means it will be done much more often -- probably commonly, because of advertisers.