DNS filtering is weak and there are numerous bypasses [0], including ones you can never fix at the DNS layer [1]
[0] Ex: https://news.ycombinator.com/item?id=30412070
[1] https://news.ycombinator.com/item?id=30411049