Bypass Private DNS Mode

Does your son have root privileges? If he has then there isn't much you can do to force DNS on the device.  There isn't a push button solution.   I would recommend that you make your DNS selection persist on his phone by assigning Next DNS servers in the AP/modem/router you are using and create a captive portal if necessary to resolve all requests through your established changes to router.

The other solution would be to have phone require a custom VPN service where you have installed the client and configured it to do what's needed.  Unless he is running a very old phone.  I wouldn't try to go cheap and I'd bring him in on it as a necessary component of securing him and the phone's communication.  That way you are being transparent and not having to outsmart him or ninja some things that could be undone.  The best security requires that it is used by the users of it and not subverted for brevity or convenience.  Good luck  

If it comes to computers and the internet usually you can't outsmart a kid. Just talk to him, be a parent, set some boundaries. Don't try act like you're some FBI agent.