You can still block at network level by configuring your router to intercept all port 53 traffic, redirect DNS-over-HTTPS using firewall rules for known DoH providers, and employ TLS inspection on your gateway for complete control.