This is network level, and it's taking the name lookups, which are done before picking the connecting endpoints, so SSL doesn't matter. It's not rewriting the stream, it's just saying, someone is trying to get an endpoint at this particular name and I am going to give it a different IP than the "world" would. Nothing of that is happening inside the https link. Eg, you get https://whatever.com/whateverelse... it will see the DNS lookup for whatever.com regardless of procotol.

I believe rhexs's point is that it's using the same domains for video data and ad data - i.e. you're seeing hxxps://youtube.com/video_data, hxxps://youtube.com/ad_data, hxxps://youtube.com/video_data..., so filtering at the DNS level doesn't work.