Using "dig @1.2.3.4 domain.tld" is not sent to 1.2.3.4, but answered by the Unify Gateway.
This prevents using custom DNS servers.

Disabling content filtering stops that behavior.

Using DoH (DNS over HTTPS) also gives correct results.