This is why throwing an extra DNS server on the network doesn't truly work. You have to actually remove the DNS protocol from existence entirely and perform TLS inspection if you want to filter effectively. This of course requires you to install a certificate authority on all devices connected to the network. Otherwise devices and applications will get around you with stuff like this, or DoT/DoH.

TLS inspection is starting to reach general availability but it's pricey. You could probably set something up if you own your router. The only vendor I know offering it OOTB is Ubiquiti/UniFi and only on their more expensive enterprise units that advertise "NeXT AI Cybersecurity". I have a hunch there is no actual AI or even ML involved, but this is the world we live in now.