Why should legit users need to check whether a packet is to a dns server or not?
And blocking https packets with mere confidence is impossible.
And blocking https packets with mere confidence is impossible.
So, yeah, I can serve up DOH on my own server with a custom endpoint, custom client configuration, and generate cover traffic. But that's not exactly easy. And http doesn't help: I can do that without http, something like https://github.com/yrutschle/sslh, or using SNI (which, as of TLS 1.3, is encrypted).
And merely saying something is impossible doesn't make it so. It doesn't even make it hard.