24H2+ versions of Windows don't allow any apps to resolve domains unless DNS caching service is enabled, but enabling that servuce means that Windows firewall cannot stop any applications from resolving domains. It can only stop connections to those domains for blocked application, but not resolution of those domains (which is performed by DNS caching service). Such wasn't the case with 23H2 and earlier versions of Windows, where DNS cache service disablement would allow each application perform domain resolution on its own and blocking application in Windows firewall would prevent domain resolution by applications, not just connections to domains resolved applications. I thought by now there would be a workaround, but I can't find out. One must resort to hosts file management and/or third-party apps to control domain resolution. Windows Firewall doesn't do anything for that...
Your options, in practice: Hosts file , still fully honored (checked before any network query), good for static blocklists, but doesn't scale well for large lists or dynamic domains and can cause the sluggishness some users report on huge hosts files under 24H2. Local resolver/proxy you control , run something like Acrylic DNS Proxy, dnscrypt-proxy, or a local Pi-hole/AdGuard Home instance, point Windows' adapter DNS at it, and do domain filtering there. This won't be per-app, but it centralizes blocking outside Dnscache's black box. Third-party firewalls with their own kernel driver/LSP (rather than just a WFP GUI wrapper like Windows Firewall Control) can sometimes reclaim per-app attribution, but most modern ones (Simplewall included) sit on top of WFP and inherit the same limitation. SNI/TLS inspection at a local proxy. tools that do per-app routing through a local SOCKS/HTTP proxy (or split-tunnel VPN-style client) can filter by the actual destination host from the TLS ClientHello, sidestepping DNS entirely.
You can block UDP port 53. On top of it, I also block TCP port 853 except for dedicated DNS servers (Adguard/NextDNS), I like DoT over DoH, because it can be easily controlled and blocked. Code: netsh advfirewall firewall add rule name="DNS UDP Block" dir=out action=block protocol=UDP remoteport=53 netsh advfirewall firewall add rule name="TCP DoT Block" dir=out action=block protocol=TCP remoteport=853 remoteip=0.0.0.0-45.90.28.98,45.90.28.100-45.90.30.98,45.90.30.100-94.140.14.13,94.140.14.15-94.140.15.14,94.140.15.16-255.255.255.255
Er... If you block UDP port 53 in general, then it also blocks it for DNS caching service and as such, there would no resolution of domains at all for any apps. Blocking UDP port 53 for any specific app does not prevent resolution of domains for that app because all domain resolution goes through DNS cache service. DNS cache service basically acts as middle-man service for for domain resolution for all and any app, including system itself.