I am running an the Open Source OpenWrt router firmware and wish to disable DoH and DoT for the whole network. In my network lots of latest iOS and macOS devices.
To disable DoH for Firefox is used this guide Canary domain - use-application-dns.net. I search for a similar solution for Apple based devices.
Apple's iOS 14 and macOS 11 will support both DNS over HTTPS and DNS over TLS (DoT) when they are released in the fall of 2020.
There's no similar network-wide opt-out canary domain feature for iOS and macOS in general. However, if you use for example Firefox on macOS, you can use that feature to disable it for that one browser in particular - unless the user opts-in to DoH/DoT in which case the feature does not do anything.
You can usually block DoT in your OpenWrt router by blocking outgoing port 853. You can usually block DoH by blocking port 443, however that would also mean blocking most web sites.
Note that if you do block port 853 in your router, iOS will give the user a warning that encrypted DNS is being blocked by the network!
If there's a specific DNS server (or smaller list of servers) that you do not want to be used on your network, you can block all traffic to that IP address in your OpenWrt router. Similar warnings apply.
Finally if you have control over the Apple devices yourself, you can use MDM to change their DNS settings. In particular you could for example enable DoH and point it to your own server - or point it to a server that doesn't exist - effectively disabling it.
