If they can't get to their preferred DNS servers directly then they use DNS-over-HTTPS which you can't block.