Block SecureDNS (DoH, DoT, DNSCrypt)

What are typical applications that would use custom DNS (any examples?), and how do one add an IP-tables rule to block them? (Sorry for noob questions, trying to learn :slight_smile: )