Block DoH without deep inspection

[wilfordbrimley]

Is it possible to block DoH (DNS over HTTPS) without using deep packet inspection? This would be for a guest network, so devices cannot be configured with the cert needed for DPI to function. 

[Cajuntank]

So let's think about what you are asking. HTTPS operates over 443 and is encrypted. So the only way you know what's inside that port's encrypted traffic (to know what it even is as it might be DNS, it might be standard web traffic, etc...), is if you are able to decrypt it (deep packet inspection). Now, if the server(s) you are communicating to for DoH are known via a list of IPs or hostnames, then you can block access to those, but that has nothing to do with DoH and purely IP blocking and DNS filtering logic.