In addition to this if one runs unbound as their DNS on their home router and they block DoH then one could add local-zone: "it" always_nxdomain to NXDOMA

In addition to this if one runs unbound as their DNS on their home router and they block DoH then one could add local-zone: "it" always_nxdomain to NXDOMAIN all requests for the .it TLD and protect non browser devices. I use this method to stay off sanctioned country TLD's and to remove the cheap/free spammy domains and TLD's that often contain more malware than anything useful.