The gist seems to be: Windows Firewall will block outbound connections to IPs that haven't been returned in responses from "blessed" DoT or DoH servers. This w

The gist seems to be: Windows Firewall will block outbound connections to IPs that haven't been returned in responses from "blessed" DoT or DoH servers. This would likely be excruciating to use and kinda pointless for general use PCs (given how much stuff will probably break in the short term). Maybe that's an intended use case long-term but it's not there now. I could see this being useful for task-oriented boxes that have no business connecting to arbitrary destinations. I also like the idea of using this as a method to funnel all DNS traffic into the system resolver and into controlled DNS servers. I like that this also kills the application-layer DNS arms race. Implementing a 75% solution akin to this on Linux wouldn't be too tremendously hard, either. All the pieces and parts are already there to do it.