[sbt567]

Nice writeup.

I'm wondering though. If the block is on DNS level, isn't it easier and cheaper to use dns-over-https or dot instead?

[martheen]

If it's just DNS, yes. But more and more countries start using SNI filtering for blocking, which can be bypassed by locally running obfuscation tool, but at some point one can get annoyed enough and just use a VPN entirely.