Hmm, but the goal is not to hide the Host header, but to hide the SNI and DNS query. Connecting to dns.google and sending a Host of whatever.google.com may work, but it is still blockable because the censor sees a connection to dns.google. You need the opposite: connecting to whatever.google.com and sending a Host of dns.google. In my tests, the latter technique does not work.
I believe this is what you are describing. It “works” in the sense of returning a response, but the censor still sees a DNS query and SNI for dns.google, which means it can be blocked.
$ curl -H 'Host: docs.google.com' 'https://dns.google/resolve?name=example.com&type=A'
{"Status":0,"TC":false,"RD":true,"RA":true,"AD":true,"CD":false,"Question":[{"name":"example.com.","type":1}],"Answer":[{"name":"example.com.","type":1,"TTL":13490,"data":"93.184.216.34"}]}
What you really want is the following, but in my tests it does not work:
$ curl -H 'Host: dns.google' 'https://docs.google.com/resolve?name=example.com&type=A'
<!DOCTYPE html>
<html lang=en>
<meta charset=utf-8>
<meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
<title>Error 404 (Not Found)!!1</title>
...
<a href=//www.google.com/><span id=logo aria-label=Google></span></a>
<p><b>404.</b> <ins>That’s an error.</ins>
<p>The requested URL <code>/resolve</code> was not found on this server. <ins>That’s all we know.</ins>
Note, in these examples I used the JSON /resolve endpoint, not the RFC 8484 /dns-query endpoint, but I believe the result is the same in terms of domain fronting.
