You can use a port reflector service. No ip.com might still offer it. Basically forwards anything incoming to their ip on port 25 to your ip and whatever port you specify.
For rather cheap I can see what traffic is suspicious. If you throw more resources at the problem and scale up it becomes simple to see traffic that looks like dns over https without having to decrypt it. Indicators such as size, frequency, consistent traffic going from your host to your DoH provider and then traffic going to other parts of the internet….these patterns become easy to establish. Once you have a good idea that a host on the internet is a DoH provider you can drop it into that category and block it.
A significant amount of trade skill knowledge and examples are tied up in YouTube. Does anyone remember building a deck before YT? You would go to the library, make copies of books or magazines that had a general idea on how to do it, then you would try to do it yourself and things would go wrong constantly.
There’s a lot of this type of stuff that would simply be lost. It’s not unusual to find videos from 15 years ago that are still relevant today.
If I wanted to do this today I would use iTunes and an old iPhone as the mp3 player. I would use an old laptop to rip, or iTunes to purchase.