This is why I’m a bit conflicted about DoH and ODoH. Firefox and Chrome have defaulted to DoH for years if I’m not mistaken (although I’m in Europe so I believe my FF still uses regular DNS instead of DoH by default).

This also means that DoH effectively sends all your queries to CloudFlare on FF. Chrome is slightly smarter and tries to map your DNS provider to a DoH implementation if known.

You can intercept normal DNS with iptables rules.

The best way to deal with a TV you don't trust is what no one wants to hear.

Open up the back and disconnect the wifi antenna. It is easy to open them up and everything is pretty simple and obvious once you do.

I block known DoH servers on my lan and forward all dns requests to my dns server.