[mox1]

I utilize pfSense to hijack all outgoing port 53 connections and just re-route them to the local DNS server.

From there, I allow AdGuard DNS out over port 953.

I then use pfBlockerNG with a few block-lists to block DoH and known DNS over 443 servers.

Overall works fairly well, I've had an issue or two when a device cant talk to 1.1.1.1 directly....