Looking for ideas to get basic web blocking working again for all my clients.

Have noticed that after FireFox (FF) started using DNS over HTTPS (DoH) all blocking began to fail for users with FF clients.

Have tried Web Groups with Web Group filtering as well as URL filtering with full URLs, and with keywords.

Other clients, such as Safari remain blocked.

Also, those rules prevent command line (CLI) nslookup for resolving the blocked web sites.

Is TP-Link behavior control really only blocking DNS queries for addresses instead of analysis of the HTTP destination?

Any solutions?

Thank you