how I've seen it done is by blocking all public DoH servers at the DNS and ip+port level. This isn't hard at all and there are plenty of public and non-public s

how I've seen it done is by blocking all public DoH servers at the DNS and ip+port level. This isn't hard at all and there are plenty of public and non-public sources that maintain such lists. Since you mentioned forti* and block pages, it is likely that they're using their internal CA instead of a public one which explains the warning you're getting on your device. Fortinet also has the ability to categorize, inspect and block DoH/DoT, check this out: https://docs.fortinet.com/document/fortigate/7.0.0/new-features/620551/dns-inspection-with-dot-and-doh https://docs.fortinet.com/document/fortigate/7.0.0/new-featu... For German law, as I understand it, so long as they don't keep logs of traffic they can block whatever they want. Or, they can keep logs that anonymize the source ip and user completely. What they can't do is block a website and record the IP that was making the request without permission from the user that generated the traffic.