I block known DoH servers on my lan and forward all dns requests to my dns server.