We ran in to a big issue with multi-site VPNs and Active Directory where we believe EDNS ECS are returning different results based on location. The documentation should be updated to state EDNS/ECS are on, DNS Filter should consider alternate DNS resolver addresses without EDNS like Quad9, and documentation should reflect you CAN NOT have queries across sites or DNS effectively breaks. It's not optional, as the documentation makes it appear.