You don’t mitm the DoH, you substitute it with your own server. I have yet to see DNS/DoH “pinning”, and apps (browsers) will let your override it. Embedding D

You don’t mitm the DoH, you substitute it with your own server. I have yet to see DNS/DoH “pinning”, and apps (browsers) will let your override it. Embedding DNS entries in apps is a bad idea (as opposed to cert pinning, which is about fixed trust, and a good idea). Given that sometimes this is going to be blocked, even if they did it would fall to the host resolver.