They could block all outgoing traffic to port 53, although you could work around that by setting up a DNS server on a different port outside the network

Yes I'm pretty sure this is what they do. The DHCP from the router gives 75.75.75.75 and 75.75.76.76. I've tried overriding that with different resolvers in my /etc/resolv.conf and it doesn't work. And logging in to the modem/router config does not offer any option to change DNS settings.

i wonder if this will circumvent that sort of blocking: https://support.mozilla.org/en-US/kb/firefox-dns-over-https

I just tried it. I enabled it at the "Max Protection" level, used the default provider setting (Cloudflare) and it works. So it seems the answer is yes. So that's a pretty simple workaround that covers most cases. I'm guessing that most of the DNS lookups that people would want to be private are happening via a web browser.

edit the /etc/resolv.conf with your chosen nameservers then chattr +i /etc/resolv.conf

I'm in Germany, and running my custom opnsense router with adblocker DNS connected to one of the big DoH providers. Never had any issues, not even with using plain old DNS in port 53.

Vodafone Kable, so YMMV.

Always a bit scared to switch providers of course, you never know if you get cgnat and blocked DNS servers. They are building a Deutsche Telekom fiber to our street this summer. It's tempting for the 200 Mbps uplink, But I have no idea is it then CGNAT and do they even provide real IPv6. It's never mentioned in the advertisement.

Telekom DSL and fibre should normally be full IPv4 + v6 dual stack – they're the former state operator and have a relatively generous IPv4 address allocation.

I've run into a different problem: Akamai apparently uses DNS in order to steer you to the correct portion of their CDN, and the set of servers returned by third-party DNS servers turns out to have abysmal peering with my ISP. So third party DNS isn't really useable for me unless I'd run my own custom resolver in order to special-case Akamai.