[silon42]

firewall anything that doesn't go through your DNS server... at least thay way the malware will be obviously detectable.

[Spivak]

But DoH is just any other HTTP request. This is the downside of networks blocking everything except 80/443 outbound and browsers not supporting SRV records.