Yes. You would be malicious. Doesn't matter what your intentions are if someone with bad intensions could do something bad in that scenario. For example redire

Yes. You would be malicious. Doesn't matter what your intentions are if someone with bad intensions could do something bad in that scenario. For example redirecting the user to a fake webpage asking for their username and password. A user will learn that there's blocking if they try and access Netflix and it doesn't work. You can get something like a Juniper SRX firewall which can recognise applications via signature and do blocking that way. Rather than against IP ranges only. Also as a network admin you're not saying why you won't be able to block DNS over HTTPS providers. Unless you're thinking there's going to be some unknown DNS server used by the browser. But if that's your fear you'll need to block all the online DNS lookup websites. What if a user just types the IP address directly? Totally circumnavigates DNS.