You run a DoH or DoT proxy on your edge device or a caching resolver that supports DoH on your edge device, serve DNS from the edge device over DHCP and block outbound DNS from other devices on the network at the firewall. Doesn’t fix evil Google devices that intentionally use DoH to bypass DNS blocking, but there are ways (more complicated, unfortunately) to fix that too.
I use unbound as my edge resolver, and you can use this to help prevent _some_ rogue DoH clients
# nx domain for disabling firefox DoH, so we can still get adblocking
# https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet
local-zone: "use-application-dns.net" always_nxdomain
