This is why I don't run pihole or NextDNS at the network level anymore, my wife had too many annoyances with slick deals and other things. Whitelists covered most but not everything.
Running the browser remotely is one way. I usually abuse archive.is or brow.sh or startpage's anonymous browsing to that affect. Cloudflare bought a startup in the space...let's see what they come up with for the consumers: https://techstartups.com/2020/01/07/cloudflare-buys-remote-b...
May be, NextDNS and others through their in-browser plugin can optionally follow the redirects (remotely) to find if the eventual destination is not blacklisted (but that's too much of an ask since following HTTP redirects is different from DNS CNAMEs).