> Most malicious ISPs disable DoH (ex: Verizon) so it likely wouldn’t have solved this.

Is this confirmed? I couldn't find a source for this statement.

How can they disable DoH? That's Dns over HTTPS.

How do they disable DoH? They block TLS over that port?

Thats DoT, DoH ist just a dns query over https(443)

Alright, I repeat my question, since it's almost identical: how do they block that? HTTPS starts with opening a TLS socket, how do they reliably determine that they can drop that traffic?

I don't know if Verizon is actively doing it, but since most providers that offer DoH have well-known IPs, like 8.8.8.8, 1.1.1.1, 9.9.9.9, they could easily just block traffic heading in that direction.

This follows along with what I read, at first it’s easy to block but it’s a losing proposition because anyone can stand up a doh server (which is also a network security nightmare)

Not sure what has changed security wise. Any one could also stand a DNS resolver. Many people use hosts file or used a local resolver for dev domains for example, security minded folks setup up resolvers on openWRT stack router for example or a use a piHole.

Blocking popular DNS providers is a common tactic deployed by ISPs. It is technically easy enough to bypass depending on your skill level and interest in doing so. Their strategy is make it difficult for majority of their users, who won't know or care, users doing all this will not make substantial impact on revenue generated from selling this data, or from showing adds etc so they don't make the effort.

DoT/DoH is not going to change this, Firefox's market share is not enough for that. I don't see Chrome or Safari implementing this functionality at all.

Okay that’s great for my developers now what happens when they download some malicious script modified their doh queries to use their servers instead of my corporate wins?

I don't think they do that.

Mozilla provides instructions for network operators that want to block it.