DNS adblocking is part of a multi-layered defense strategy. It's defeated by ads being served from the same domain as content. I know that more advanced options like pfblocker allow interrogating "fronting" subdomains to detect those that resolve to an ad-server (e.g. funstuff dot domain dot net actually resolves to eviladtechcompany dot ai) and block them as well and that helps a bit but the best defense is having on-device blockers as well.

There's also a lot more ad tech companies that rapidly deploy domains and subdomains to attempt to overwhelm ad list maintainers and they often succeed for a time in a real back and forth battle.

It's also possible the goodreads app has hardcoded secure DNS servers (that don't use the standard DNS port but often 443) that they use to bypass DNS blocking by resolving their ad domains themselves. In that case you'd want to implement a firewall list of the biggest DNS resolvers (for example like this list here I found with a quick search) and prevent any traffic from within your network from reaching them by either dropping or blocking. Importantly you want to ensure that your DNS resolver can still reach the root servers or whatever you're querying but any other device should be blocked from accessing these. You should also be either redirecting the standard DNS port (53) to your DNS server if locally served or blocking it except for any necessary local DNS servers.