I redirect all out going dns requests to my self hosted DNS server. Only one I can’t block is DoH. DoT is easily blocked and my firewall picks up on it.