Comment by InsidiousWombat
5 hours ago
https://github.com/net4people/bbs/issues/295 China for example ?
It's just few IPs on a known port. It's trivial to block.
now if the cloud providers ran it on every of their internet facing load balancers so you could use any of their IPs for DNS maybe it would be more effective, but as it is, it is entirely trivial to block it.
We actually did it for corporate network for entirely different reason, we just have a bunch of internal-only DNS zones and want browser to use that.
The whole point of DoH is that the "known port" is the encrypted one the whole Internet runs over (443/tcp), which makes it more difficult to block than DoT.