Speaking of not wanting DoH to exist on the local network, does anyone know if there is anything pre-existing that can hook into firewall rules to default deny

Speaking of not wanting DoH to exist on the local network, does anyone know if there is anything pre-existing that can hook into firewall rules to default deny outgoing traffic and only allow (until TTL expiry) in response to a DNS lookup? That way things cannot bypass your DNS filtering with DoH or hardcoded IPs.