DNS over TLS is easy to block (it is separate port), that's why browsers are pushing for DNS over HTTPS, so you cannot make them fall back on local DNS so easil

DNS over TLS is easy to block (it is separate port), that's why browsers are pushing for DNS over HTTPS, so you cannot make them fall back on local DNS so easily. With DoH, it will be more difficult, but still possible - you will have to run your own proxy. I imagine, that folks that came up pihole, will package something similar that includes proxy. On such networks, devices that won't allow to enroll custom certificates won't get onto Internet. It is then up to the user, what he or she prefers, privacy and control or that specific product. I actually like DoT a DoH as protocols, from the privacy point of view. However, I don't like their implementations and the lockdown they are used for, where they try to establish the tunnel out of the local networks, taking control out of their owners.