We already blocked known public DoH server domains by NxFilter at default. Since they use DoH URLs, they need to resolve DoH server domain first. So, you can block them by NxFilter. However, you may need to block DoH server IPs by firewall to be sure.
-- [IP List]
1.0.0.1
1.0.0.2
1.0.0.3
1.1.1.1
1.1.1.2
1.1.1.3
3.34.32.82
5.1.66.255
5.2.75.75
5.45.107.88
8.8.4.4
8.8.8.8
8.20.247.20
8.26.56.26
9.9.9.9
9.9.9.10
9.9.9.11
13.89.120.251
17.253.84.119
17.253.84.247
17.253.86.129
17.253.86.131
40.76.112.230
45.11.45.11
45.63.30.163
45.67.219.208
45.76.113.31
45.86.125.59
45.91.92.121
45.153.187.96
45.155.171.163
46.101.66.244
46.226.108.173
46.226.109.82
46.226.110.211
46.227.200.52
46.227.200.54
46.227.200.55
46.227.203.52
46.227.207.52
64.78.200.1
64.78.201.1
65.108.87.118
66.42.33.135
72.34.38.64
74.82.42.42
75.75.77.99
76.76.2.11
76.76.21.93
76.76.21.123
78.46.244.143
78.47.163.141
78.47.212.211
79.110.170.43
80.156.145.201
81.187.221.24
88.198.91.187
89.38.131.38
89.45.227.53
89.233.43.71
91.239.96.35
91.239.100.100
92.223.109.19
94.140.14.14
94.140.14.15
94.140.14.140
94.140.14.141
94.140.15.15
94.140.15.16
95.216.181.228
95.216.212.177
95.217.25.217
101.101.101.101
101.198.191.4
101.198.192.33
101.198.193.29
103.2.57.5
103.2.57.6
103.127.124.46
103.167.150.45
104.16.132.229
104.16.133.229
104.16.248.249
104.16.249.249
104.21.33.14
104.21.46.152
104.21.49.234
104.21.89.92
104.21.91.14
104.26.8.190
104.26.9.190
104.244.78.231
109.70.100.134
116.202.176.26
116.202.233.144
116.203.32.217
116.203.215.58
130.59.31.248
130.59.31.251
130.225.244.166
130.226.161.34
136.144.215.158
139.59.48.222
141.164.35.160
141.164.63.208
144.22.247.219
145.100.185.15
145.100.185.16
145.100.185.17
145.100.185.18
146.112.41.2
146.112.41.3
146.112.41.4
146.255.56.98
149.56.228.45
149.112.112.9
149.112.112.10
149.112.112.11
149.112.112.112
149.112.121.10
149.112.121.20
149.112.121.30
149.112.122.10
149.112.122.20
149.112.122.30
149.248.217.117
152.67.165.26
157.90.124.62
158.64.1.29
159.69.114.157
162.14.21.56
162.14.21.178
162.55.169.60
162.159.61.3
162.159.61.4
167.114.220.125
167.235.236.107
172.64.41.3
172.64.41.4
172.65.135.187
172.67.75.111
172.67.139.137
172.67.139.164
172.67.140.94
172.67.164.149
172.67.195.148
172.104.93.80
174.68.248.77
174.138.29.175
175.24.154.66
176.9.1.117
176.9.93.198
184.105.193.78
185.38.27.139
185.43.135.1
185.49.141.38
185.95.218.42
185.95.218.43
185.134.196.52
185.134.196.54
185.134.196.55
185.150.99.255
185.213.26.187
185.222.222.222
185.228.168.9
185.228.168.10
185.228.168.168
185.235.81.1
185.235.81.2
185.235.81.3
185.235.81.4
185.235.81.5
185.235.81.6
185.235.81.81
185.235.83.83
193.17.47.1
193.148.249.126
193.180.80.1
193.180.80.2
194.242.2.2
194.242.2.3
198.180.150.12
199.58.83.33
199.195.251.84
200.1.123.46
208.67.220.123
208.67.220.220
208.67.222.123
208.67.222.222
209.141.34.95
212.52.0.233
213.196.191.96
217.160.156.119
217.169.20.22
217.169.20.23
223.5.5.5
223.6.6.6
-- [Domain List]
1dot1dot1dot.cloudflare-dns.com
1dot1dot1dot1.cloudflare-dns.com
2.dnscrypt-cert.dns.seby.io
a.family.ns.dnslify.com
a.ns.dnslify.com
a.safe.ns.dnslify.com
adblock-dot.dnswarden.com
adblock.dns.mullvad.net
adblock.doh.mullvad.net
adblock.mydns.network
adfree.usableprivacy.net
ads-doh.securedns.eu
adult-filter-dns.cleanbrowsing.org
adult-filter-dot.dnswarden.com
anycast.censurfridns.dk
anycast.ffmuc.net
anycast.uncensoreddns.org
apple.nextdns.io
applied-privacy.net
asia.dnscepat.id
asia.doh.sb
b.family.ns.dnslify.com
b.ns.dnslify.com
b.safe.ns.dnslify.com
basic.bravedns.com
bravedns.com
canadianshield.cira.ca
chrome.cloudflare-dns.com
cloudflare-dns.com
cloudflare-gateway.com
cname.vercel-dns.com
commons.host
deic-lgb.anycast.censurfridns.dk
deic-lgb.anycast.uncensoreddns.org
deic-ore.anycast.censurfridns.dk
deic-ore.anycast.uncensoreddns.org
digitale-gesellschaft.ch
dns-asia.wugui.zone
dns-doh.dnsforfamily.com
dns-dot.dnsforfamily.com
dns-family.adguard.com
dns-nosec.quad9.net
dns-nyc.aaflalo.me
dns-tls.bitwiseshift.net
dns-unfiltered.adguard.com
dns.aa.net.uk
dns.aaflalo.me
dns.adguard.com
dns.alekberg.net
dns.alidns.com
dns.arapurayil.com
dns.bitgeek.in
dns.blokada.org
dns.brahma.world
dns.cfiec.net
dns.cloudflare.com
dns.cmrg.net
dns.comss.one
dns.containerpi.com
dns.decloudus.com
dns.developer.li
dns.digitale-gesellschaft.ch
dns.dns-over-https.com
dns.dnshome.de
dns.dnsoverhttps.net
dns.dnswarden.com
dns.east.comss.one
dns.flatuslifir.is
dns.google
dns.google.com
dns.hostux.net
dns.larsdebruin.net
dns.moulticast.net
dns.mrkaran.dev
dns.mullvad.net
dns.neutopia.org
dns.nextdns.io
dns.nixnet.xyz
dns.oszx.co
dns.pub
dns.pumplex.com
dns.quad9.net
dns.rubyfish.cn
dns.switch.ch
dns.t53.de
dns.twnic.tw
dns.wugui.zone
dns1.digitale-gesellschaft.ch
dns1.dnscrypt.ca
dns1.nextdns.io
dns1.steering.nextdns.io
dns10.quad9.net
dns11.quad9.net
dns2.alekberg.net
dns2.developer.li
dns2.digitale-gesellschaft.ch
dns2.dnscrypt.ca
dns2.nextdns.io
dns2.steering.nextdns.io
dns64.cloudflare-dns.com
dns64.dns.google
dns9.quad9.net
dnscache.e-utp.net
dnses.alekberg.net
dnsforge.de
dnsnl.alekberg.net
dnsotls.lab.nic.cl
dnsovertls.sinodun.com
dnsovertls1.sinodun.com
dnsovertls2.sinodun.com
dnsovertls3.sinodun.com
dnsse.alekberg.net
doh-2.seby.io
doh-ch.blahdns.com
doh-de.blahdns.com
doh-fi.blahdns.com
doh-jp.blahdns.com
doh-sg.blahdns.com
doh.360.cn
doh.42l.fr
doh.abmb.win
doh.applied-privacy.net
doh.appliedprivacy.net
doh.armadillodns.net
doh.au.ahadns.net
doh.blockerdns.com
doh.captnemo.in
doh.centraleu.pi-dns.com
doh.chi.ahadns.net
doh.cleanbrowsing.org
doh.crypto.sx
doh.defaultroutes.de
doh.dns.apple.com
doh.dns.apple.com.v.aaplimg.com
doh.dns.sb
doh.dnslify.com
doh.dnswarden.com
doh.eastas.pi-dns.com
doh.eastau.pi-dns.com
doh.eastus.pi-dns.com
doh.es.ahadns.net
doh.familyshield.opendns.com
doh.ffmuc.net
doh.gslb2.xfinity.com
doh.in.ahadns.net
doh.it.ahadns.net
doh.la.ahadns.net
doh.li
doh.libredns.gr
doh.libredns.org
doh.mullvad.net
doh.netweaver.uk
doh.nl.ahadns.net
doh.no.ahadns.net
doh.northeu.pi-dns.com
doh.ny.ahadns.net
doh.opendns.com
doh.pi-dns.com
doh.pl.ahadns.net
doh.powerdns.org
doh.pub
doh.sandbox.opendns.com
doh.seby.io
doh.securedns.eu
doh.tiar.app
doh.tiarap.org
doh.westus.pi-dns.com
doh.xfinity.com
doh1.b-cdn.net
doh1.blahdns.com
doh2.abmb.win
doh2.b-cdn.net
doh2.blahdns.com
doh2.gslb2.xfinity.com
dohdot.coxlab.net
dohtrial.att.net
dot.360.cn
dot.centraleu.pi-dns.com
dot.eastas.pi-dns.com
dot.eastau.pi-dns.com
dot.eastus.pi-dns.com
dot.ffmuc.net
dot.libredns.gr.com
dot.northeu.pi-dns.com
dot.pub
dot.seby.io
dot.securedns.eu
dot.tiar.app
dot.westus.pi-dns.com
ea-dns.rubyfish.cn
ecs-doh.dnswarden.com
eropa.dnscepat.id
eu1.dns.lavate.ch
example.doh.blockerdns.com
family-filter-dns.cleanbrowsing.org
family.canadianshield.cira.ca
family.cloudflare-dns.com
fdns1.dismail.de
fdns2.dismail.de
fi.doh.dns.snopyta.org
fi.dot.dns.snopyta.org
firefox.dns.nextdns.io
free.bravedns.com
freedns.controld.com
getdnsapi.net
google-public-dns-a.google.com
google-public-dns-b.google.com
ibksturm.synology.me
ibuki.cgnat.net
jarjar.meganerd.nl
jcdns.fun
jit.ddns.net
jp.tiar.app
jp.tiarap.org
kaitain.restena.lu
kr-sel.doh.sb
kracon.anycast.censurfridns.dk
kracon.anycast.uncensoreddns.org
lux1.nixnet.xyz
lv1.nixnet.xyz
mozilla.cloudflare-dns.com
nextdns.io
ns1.dnsprivacy.at
ns1.recursive.dnsbycomodo.com
ns2.dnsprivacy.at
ns2.recursive.dnsbycomodo.com
ny1.nixnet.xyz
odvr.nic.cz
one.one.one.one
ordns.he.net
p0.freedns.controld.com
p1.freedns.controld.com
p2.freedns.controld.com
p3.freedns.controld.com
pdns.faelix.net
privacydns.go6lab.si
private.canadianshield.cira.ca
protected.canadianshield.cira.ca
public-dns-a.dns.sb
public-dns-b.dns.sb
public.dns.iij.jp
puredns.org
rdns.faelix.net
resolver-eu.lelux.fi
resolver1-fs.opendns.com
resolver1.opendns.com
resolver2-fs.opendns.com
resolver2.opendns.com
rgnet-iad.anycast.censurfridns.dk
rgnet-iad.anycast.uncensoreddns.org
rpz-public-resolver1.rrdns.pch.net
rumpelsepp.org
security-filter-dns.cleanbrowsing.org
security.cloudflare-dns.com
steering.nextdns.io
td-doh.dns.t53.de
tls-dns-u.odvr.dns-oarc.net
uncensored-dot.dnswarden.com
unicast.censurfridns.dk
unicast.uncensoreddns.org
us1.dns.lavate.ch
uw-dns.rubyfish.cn
www.digitale-gesellschaft.ch
-- [IP List]
1.0.0.1
1.0.0.2
1.0.0.3
1.1.1.1
1.1.1.2
1.1.1.3
3.34.32.82
5.1.66.255
5.2.75.75
5.45.107.88
8.8.4.4
8.8.8.8
8.20.247.20
8.26.56.26
9.9.9.9
9.9.9.10
9.9.9.11
13.89.120.251
17.253.84.119
17.253.84.247
17.253.86.129
17.253.86.131
40.76.112.230
45.11.45.11
45.63.30.163
45.67.219.208
45.76.113.31
45.86.125.59
45.91.92.121
45.153.187.96
45.155.171.163
46.101.66.244
46.226.108.173
46.226.109.82
46.226.110.211
46.227.200.52
46.227.200.54
46.227.200.55
46.227.203.52
46.227.207.52
64.78.200.1
64.78.201.1
65.108.87.118
66.42.33.135
72.34.38.64
74.82.42.42
75.75.77.99
76.76.2.11
76.76.21.93
76.76.21.123
78.46.244.143
78.47.163.141
78.47.212.211
79.110.170.43
80.156.145.201
81.187.221.24
88.198.91.187
89.38.131.38
89.45.227.53
89.233.43.71
91.239.96.35
91.239.100.100
92.223.109.19
94.140.14.14
94.140.14.15
94.140.14.140
94.140.14.141
94.140.15.15
94.140.15.16
95.216.181.228
95.216.212.177
95.217.25.217
101.101.101.101
101.198.191.4
101.198.192.33
101.198.193.29
103.2.57.5
103.2.57.6
103.127.124.46
103.167.150.45
104.16.132.229
104.16.133.229
104.16.248.249
104.16.249.249
104.21.33.14
104.21.46.152
104.21.49.234
104.21.89.92
104.21.91.14
104.26.8.190
104.26.9.190
104.244.78.231
109.70.100.134
116.202.176.26
116.202.233.144
116.203.32.217
116.203.215.58
130.59.31.248
130.59.31.251
130.225.244.166
130.226.161.34
136.144.215.158
139.59.48.222
141.164.35.160
141.164.63.208
144.22.247.219
145.100.185.15
145.100.185.16
145.100.185.17
145.100.185.18
146.112.41.2
146.112.41.3
146.112.41.4
146.255.56.98
149.56.228.45
149.112.112.9
149.112.112.10
149.112.112.11
149.112.112.112
149.112.121.10
149.112.121.20
149.112.121.30
149.112.122.10
149.112.122.20
149.112.122.30
149.248.217.117
152.67.165.26
157.90.124.62
158.64.1.29
159.69.114.157
162.14.21.56
162.14.21.178
162.55.169.60
162.159.61.3
162.159.61.4
167.114.220.125
167.235.236.107
172.64.41.3
172.64.41.4
172.65.135.187
172.67.75.111
172.67.139.137
172.67.139.164
172.67.140.94
172.67.164.149
172.67.195.148
172.104.93.80
174.68.248.77
174.138.29.175
175.24.154.66
176.9.1.117
176.9.93.198
184.105.193.78
185.38.27.139
185.43.135.1
185.49.141.38
185.95.218.42
185.95.218.43
185.134.196.52
185.134.196.54
185.134.196.55
185.150.99.255
185.213.26.187
185.222.222.222
185.228.168.9
185.228.168.10
185.228.168.168
185.235.81.1
185.235.81.2
185.235.81.3
185.235.81.4
185.235.81.5
185.235.81.6
185.235.81.81
185.235.83.83
193.17.47.1
193.148.249.126
193.180.80.1
193.180.80.2
194.242.2.2
194.242.2.3
198.180.150.12
199.58.83.33
199.195.251.84
200.1.123.46
208.67.220.123
208.67.220.220
208.67.222.123
208.67.222.222
209.141.34.95
212.52.0.233
213.196.191.96
217.160.156.119
217.169.20.22
217.169.20.23
223.5.5.5
223.6.6.6
-- [Domain List]
1dot1dot1dot.cloudflare-dns.com
1dot1dot1dot1.cloudflare-dns.com
2.dnscrypt-cert.dns.seby.io
a.family.ns.dnslify.com
a.ns.dnslify.com
a.safe.ns.dnslify.com
adblock-dot.dnswarden.com
adblock.dns.mullvad.net
adblock.doh.mullvad.net
adblock.mydns.network
adfree.usableprivacy.net
ads-doh.securedns.eu
adult-filter-dns.cleanbrowsing.org
adult-filter-dot.dnswarden.com
anycast.censurfridns.dk
anycast.ffmuc.net
anycast.uncensoreddns.org
apple.nextdns.io
applied-privacy.net
asia.dnscepat.id
asia.doh.sb
b.family.ns.dnslify.com
b.ns.dnslify.com
b.safe.ns.dnslify.com
basic.bravedns.com
bravedns.com
canadianshield.cira.ca
chrome.cloudflare-dns.com
cloudflare-dns.com
cloudflare-gateway.com
cname.vercel-dns.com
commons.host
deic-lgb.anycast.censurfridns.dk
deic-lgb.anycast.uncensoreddns.org
deic-ore.anycast.censurfridns.dk
deic-ore.anycast.uncensoreddns.org
digitale-gesellschaft.ch
dns-asia.wugui.zone
dns-doh.dnsforfamily.com
dns-dot.dnsforfamily.com
dns-family.adguard.com
dns-nosec.quad9.net
dns-nyc.aaflalo.me
dns-tls.bitwiseshift.net
dns-unfiltered.adguard.com
dns.aa.net.uk
dns.aaflalo.me
dns.adguard.com
dns.alekberg.net
dns.alidns.com
dns.arapurayil.com
dns.bitgeek.in
dns.blokada.org
dns.brahma.world
dns.cfiec.net
dns.cloudflare.com
dns.cmrg.net
dns.comss.one
dns.containerpi.com
dns.decloudus.com
dns.developer.li
dns.digitale-gesellschaft.ch
dns.dns-over-https.com
dns.dnshome.de
dns.dnsoverhttps.net
dns.dnswarden.com
dns.east.comss.one
dns.flatuslifir.is
dns.google
dns.google.com
dns.hostux.net
dns.larsdebruin.net
dns.moulticast.net
dns.mrkaran.dev
dns.mullvad.net
dns.neutopia.org
dns.nextdns.io
dns.nixnet.xyz
dns.oszx.co
dns.pub
dns.pumplex.com
dns.quad9.net
dns.rubyfish.cn
dns.switch.ch
dns.t53.de
dns.twnic.tw
dns.wugui.zone
dns1.digitale-gesellschaft.ch
dns1.dnscrypt.ca
dns1.nextdns.io
dns1.steering.nextdns.io
dns10.quad9.net
dns11.quad9.net
dns2.alekberg.net
dns2.developer.li
dns2.digitale-gesellschaft.ch
dns2.dnscrypt.ca
dns2.nextdns.io
dns2.steering.nextdns.io
dns64.cloudflare-dns.com
dns64.dns.google
dns9.quad9.net
dnscache.e-utp.net
dnses.alekberg.net
dnsforge.de
dnsnl.alekberg.net
dnsotls.lab.nic.cl
dnsovertls.sinodun.com
dnsovertls1.sinodun.com
dnsovertls2.sinodun.com
dnsovertls3.sinodun.com
dnsse.alekberg.net
doh-2.seby.io
doh-ch.blahdns.com
doh-de.blahdns.com
doh-fi.blahdns.com
doh-jp.blahdns.com
doh-sg.blahdns.com
doh.360.cn
doh.42l.fr
doh.abmb.win
doh.applied-privacy.net
doh.appliedprivacy.net
doh.armadillodns.net
doh.au.ahadns.net
doh.blockerdns.com
doh.captnemo.in
doh.centraleu.pi-dns.com
doh.chi.ahadns.net
doh.cleanbrowsing.org
doh.crypto.sx
doh.defaultroutes.de
doh.dns.apple.com
doh.dns.apple.com.v.aaplimg.com
doh.dns.sb
doh.dnslify.com
doh.dnswarden.com
doh.eastas.pi-dns.com
doh.eastau.pi-dns.com
doh.eastus.pi-dns.com
doh.es.ahadns.net
doh.familyshield.opendns.com
doh.ffmuc.net
doh.gslb2.xfinity.com
doh.in.ahadns.net
doh.it.ahadns.net
doh.la.ahadns.net
doh.li
doh.libredns.gr
doh.libredns.org
doh.mullvad.net
doh.netweaver.uk
doh.nl.ahadns.net
doh.no.ahadns.net
doh.northeu.pi-dns.com
doh.ny.ahadns.net
doh.opendns.com
doh.pi-dns.com
doh.pl.ahadns.net
doh.powerdns.org
doh.pub
doh.sandbox.opendns.com
doh.seby.io
doh.securedns.eu
doh.tiar.app
doh.tiarap.org
doh.westus.pi-dns.com
doh.xfinity.com
doh1.b-cdn.net
doh1.blahdns.com
doh2.abmb.win
doh2.b-cdn.net
doh2.blahdns.com
doh2.gslb2.xfinity.com
dohdot.coxlab.net
dohtrial.att.net
dot.360.cn
dot.centraleu.pi-dns.com
dot.eastas.pi-dns.com
dot.eastau.pi-dns.com
dot.eastus.pi-dns.com
dot.ffmuc.net
dot.libredns.gr.com
dot.northeu.pi-dns.com
dot.pub
dot.seby.io
dot.securedns.eu
dot.tiar.app
dot.westus.pi-dns.com
ea-dns.rubyfish.cn
ecs-doh.dnswarden.com
eropa.dnscepat.id
eu1.dns.lavate.ch
example.doh.blockerdns.com
family-filter-dns.cleanbrowsing.org
family.canadianshield.cira.ca
family.cloudflare-dns.com
fdns1.dismail.de
fdns2.dismail.de
fi.doh.dns.snopyta.org
fi.dot.dns.snopyta.org
firefox.dns.nextdns.io
free.bravedns.com
freedns.controld.com
getdnsapi.net
google-public-dns-a.google.com
google-public-dns-b.google.com
ibksturm.synology.me
ibuki.cgnat.net
jarjar.meganerd.nl
jcdns.fun
jit.ddns.net
jp.tiar.app
jp.tiarap.org
kaitain.restena.lu
kr-sel.doh.sb
kracon.anycast.censurfridns.dk
kracon.anycast.uncensoreddns.org
lux1.nixnet.xyz
lv1.nixnet.xyz
mozilla.cloudflare-dns.com
nextdns.io
ns1.dnsprivacy.at
ns1.recursive.dnsbycomodo.com
ns2.dnsprivacy.at
ns2.recursive.dnsbycomodo.com
ny1.nixnet.xyz
odvr.nic.cz
one.one.one.one
ordns.he.net
p0.freedns.controld.com
p1.freedns.controld.com
p2.freedns.controld.com
p3.freedns.controld.com
pdns.faelix.net
privacydns.go6lab.si
private.canadianshield.cira.ca
protected.canadianshield.cira.ca
public-dns-a.dns.sb
public-dns-b.dns.sb
public.dns.iij.jp
puredns.org
rdns.faelix.net
resolver-eu.lelux.fi
resolver1-fs.opendns.com
resolver1.opendns.com
resolver2-fs.opendns.com
resolver2.opendns.com
rgnet-iad.anycast.censurfridns.dk
rgnet-iad.anycast.uncensoreddns.org
rpz-public-resolver1.rrdns.pch.net
rumpelsepp.org
security-filter-dns.cleanbrowsing.org
security.cloudflare-dns.com
steering.nextdns.io
td-doh.dns.t53.de
tls-dns-u.odvr.dns-oarc.net
uncensored-dot.dnswarden.com
unicast.censurfridns.dk
unicast.uncensoreddns.org
us1.dns.lavate.ch
uw-dns.rubyfish.cn
www.digitale-gesellschaft.ch