If this becomes prevalent, there will be considerable outrage. So people will be discovering which devices and apps use tunneled DNS. Restricting the universe t

If this becomes prevalent, there will be considerable outrage. So people will be discovering which devices and apps use tunneled DNS. Restricting the universe to open-source stuff, that shouldn't be that hard, just from the code. Also, although blocking domains will be harder, you can always block IP addresses and ranges. DNS requests may be tunneled, but apps are still just connecting to IP addresses. So you can compare IP addresses resolved by trusted DNS servers with those that an app is requesting. And block whatever you don't want. It could become tedious, but one could build something like Pi-Hole that was easily configurable on the fly.