[Bender]

Blocking DoH at the router is almost impossible because it looks exactly the same as other HTTPS traffic.

I covered that in the comment next to this one.