You may want to see if traffic is bypassing it via the QUIC protocol. This was happening to us in the Chrome browser on Mac devices. We ended up blocking QUIC via Google Workspace Chrome Management profile and creating a QUIC blocking Firewall rule on the MX. You may also want to add things like the DNS over HTTPS/TLS category to your Firewall blocks. ... View more