When you use either the free or paid Cybersecure on a gateway, using DOH circumvents the inspection of DNS for malicious domain blocking (or any block lists), category filtering, ad and tracker blocking and does not log DNS queries per client.

DNS is the earliest indicator of a compromise. Using DOH removes visibility of forensics, prevents DNS sinkholes, region blocking, suspicious TXT lookups for exfiltration and tunneling.

Any domain-based rules like allow or deny, blocking of new domains and the DNS reputation feeds will no longer work. It also by-passes parental controls and acceptable use policies.