Just block anything going out on port 53 outside the network and keep a dns sever on the network. (useful to block known tls dns servers like cloudflares 1.1.1.

Just block anything going out on port 53 outside the network and keep a dns sever on the network. (useful to block known tls dns servers like cloudflares 1.1.1.1 as well) That is sufficient for samsung from my experience. (it does try 8.8.8.8 on its own if my ad blocking server rejects requests) It still doesn't know DNS-over-TLS but if I start seeing ads I'll disconnect it entirely.