I wonder if the best approach might be to specify the precise request format required for DoH and actively deny requests with extra information.
'Thou shalt provide exactly this, no more and no less'
Depends on whether we want to consider later 'improvements' to be silent extensions or an entirely new protocol version. Given how easily abused HTTP headers have been in the past, might be worth the inertia to limit extensibility by design in order to limit MITM tracking.
But MITM middleboxes will of course start to rely on that...
I suppose that if TLS is broken for this part of the system you're rather screwed anyway, but defence in depth is always worth considering.
'Thou shalt provide exactly this, no more and no less'
Depends on whether we want to consider later 'improvements' to be silent extensions or an entirely new protocol version. Given how easily abused HTTP headers have been in the past, might be worth the inertia to limit extensibility by design in order to limit MITM tracking.
But MITM middleboxes will of course start to rely on that...
I suppose that if TLS is broken for this part of the system you're rather screwed anyway, but defence in depth is always worth considering.