If you have the commitment to it, you can simply force all outbound connections not originating from your DNS servers to be NATed TO your DNS servers. I do thi

If you have the commitment to it, you can simply force all outbound connections not originating from your DNS servers to be NATed TO your DNS servers. I do this; no machine other than my 2 DNS servers are permitted to make outbound DNS requests (they are transparently handled by my LAN DNS). The real annoying change is the transition to DNS over HTTPS. The canary domain[1] is useful but apps are obviously free to ignore it. [1]: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...