Right, I guess as more DoH servers become available, it'll be harder to track, but you could intercept and blackhole any HTTPS traffic to one.one.one.one and other popular servers to have them fallback.