Comment by simcop2387

In this case blocking outgoing traffic to port 853 would be enough, but it won't stop DNS over HTTP. I've not found a good way to deal with that one if you want to control things, other than requiring all devices support your CA and you inspect for it.