DNS is on port 53. So block outgoing port 53 except to your own DNS server. Likewise for DNS Over TLS (DoT), on port 853. The problem is DoH, which uses the sa

DNS is on port 53. So block outgoing port 53 except to your own DNS server. Likewise for DNS Over TLS (DoT), on port 853. The problem is DoH, which uses the same port as https (443) and so is harder to block.