DNS is usually poisoned at the ISP level. ISPs provide DNS for the customers. DoH helps in two ways: You choose a different DNS resolver and it's over HTTPS so you don't have any goons meddling with it.