If I recall correctly, DoH makes calls to IP addresses like https://1.1.1.1 https://1.1.1.1 . I assume the security device is able to detect the lack of hostnam

If I recall correctly, DoH makes calls to IP addresses like https://1.1.1.1 https://1.1.1.1 . I assume the security device is able to detect the lack of hostname/SNI and block accordingly.