Tor has its own traffic signature and so can be detected by network monitoring software. If it's on the IT network I help run then I'm tracking down the source IP and MAC and finding the network port it's coming from and asking "WTF?".

I'm happy to implement DoT on work's network to help encourage encrypted DNS. My problem is DoH can now be used by all sorts garbage and we can't tell it from legitimate HTTPS--which is by design.

All this for the laudable goal of protecting Internet surfers' privacy. However I'm curious to know how well this will work against the Great Firewall of China, and how many other regimes will now implement Great Firewalls of their own.