> Client checks it? No problem, it will fallback to regular DNS. That's a good point, I'd missed that. I'd hope the browser would show a warning in this case t

> Client checks it? No problem, it will fallback to regular DNS. That's a good point, I'd missed that. I'd hope the browser would show a warning in this case though. I don't imagine there'd be any point redirecting a DoH request rather than just blocking it outright though. No serious DoH implementation is going to fail to check the cert.