On a related note, I recently found out that Chrome uses its own DNS resolver, ostensibly to improve performance. On some Android devices, this ignores the nameserver precedence set against network connections on the device. The result is that it will often send DNS queries to the nameserver attached to the physical network adapter and not the one attached to the VPN interface. It breaks queries for intranet servers and it breaks loopback-VPN-based ad blockers (a common workaround to manage your own hosts file on Android without rooting your device and breaking many root-hostile apps). There's a flag (async dns) in Android Chrome to disable the internal resolver and use the system resolver instead, but this flag is no longer present on desktop (where a startup parameter must be used).

My point is that, as alluded to in the article, changing how DNS works can have serious side effects. The fact that, as unintentional as it may have been, one of the world's biggest ad networks broke ad-blocking on a number of devices by changing how they handle DNS queries is worrying. I'm concerned that as DoH (or DoC as the article refers to it) proliferates, it'll be used less to circumvent censorship and more to take away control from end users and enterprise network administrators. Every app, the browser included, could creep towards using their own internal DNS query handler, using nameservers they trust to delivery their analytics and advertising queries.

Additionally, giving DoH/DoC choice through the browser suggests that the browser might return different results from other software on the device. This sounds disastrous.

And I suspect that the oppressive regimes that always come up in discussions about DoH would simply block the IPs of those cloud resolvers, which seem to rely on having a well-known IP or domain name.