Again, trivially easy to block that. But DoH is real HTTP(S), you cannot really distinguish it from a HTTPS request for wikipedia.org or outlook.com. The SNI h

Again, trivially easy to block that. But DoH is real HTTP(S), you cannot really distinguish it from a HTTPS request for wikipedia.org or outlook.com. The SNI hole is slowly being addressed by ESNI - https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/