I’m not saying they do. They wouldn’t even need to - they control the resolver. They could hardcode IP addresses, use domain fronting, use a CDN to proxy, load

I’m not saying they do. They wouldn’t even need to - they control the resolver. They could hardcode IP addresses, use domain fronting, use a CDN to proxy, load a list of IP addresses on every update check, … There are so many ways to circumvent DNS based blocking for someone that controls the resolver and network stack that it’s not even funny any more. The fact that no one has shown that they do any of this tells you that they’re not trying very hard to circumvent blocks. Why would that change with DoH?