Your browser (or your tv) can just skip your entire dns infra and make its own lookups over https- which you won’t see.

That’s the evil genius of doh- you can’t block 443 and their “dns server” could be the same hostname as the site you visit … and now we’re discussing mitm’ing ourselves…

Sigh.