> And you can still block ad and scam domains with DoH.

How?

There are certain browsers that ignore your DNS settings and talk directly to DoH servers. How could I check what is that the browser requesting through a SSL session?

Do you want me to spoof a cert and put it on a MITM node?

These are my nameservers:

   nameserver 10.10.10.65
   nameserver 10.10.10.66

If the browser plays along than talking to these is the safest bet for me because it runs AdGuardHome and removes any ad or malicious (these are interchangable terms) content by returning 0.0.0.0 for those queries. I use DoT as uplink so the ISP cannot look into my traffic and I use http->https upgrades for everything.

For me DoH makes it harder to filter the internet.