DNS over HTTPS and DNS over TLS

Encrypt DNS on the path. The resolver still sees the names. DoH can walk around enterprise DNS logging.

DNS over TLS wraps queries on port 853. DNS over HTTPS wraps them in HTTPS, usually on 443, looking like web traffic. Both stop a path observer from reading or casually altering the DNS exchange. Neither hides the names from the resolver you chose.

If endpoints speak DoH to a public resolver, enterprise DNS logs go quiet and policy based on that resolver is skipped. That is a telemetry and control problem, not a reason to ban encryption. Decide which resolvers are authorised, and notice clients that stop using them.