[hnbear]

You could catch and redirect all port 53 traffic to a local Pi-hole (or similar dns server) to respond with whatever you want

[dimensi0nal]

...and this is why there's a push for DNS over HTTPS/DNS over TLS

[hnbear]

And I’m not sure which is worse here. Devices on my network I can’t control, or protocols so easily circumvented.

[TheHappyOddish]

Which is why I rooted my TV, install my CA on it and forced it through my squid proxy that does SSL bumping.

My network, my rules.