DNS blocking is entirely insufficient compared to DOM interception and filtering, especially with domain fronting.