>and then also firewall blocking the TV from phoning out on port 53 in case the manufacturer has hardcoded DNS

I'm surprised they haven't switched to using DoH, which would prevent this from working.

It wouldn't even need to use any sort of standards-based DNS-like thing at all, if they control the server (on a stable IP address in the TV's firmware) and the client (the TV). It could be any data scheme (probably https for simplicity and blending in) along the lines of "give me all the other IP addresses I'll need, which aren't as stable as the one in my firmware."

Regardless, what is the benefit of putting the TV on the network but preventing it from doing DNS lookups anyway, even if you could be sure you succeed?