Sophos DNS Protection and On Prem Windows DNS Server

I've setup DNS protection but in testing the block list it's not blocking the website.

So we have a different setup. And I'm wondering if this is causing the issue.

• We have an office. 
• vpn between office and cloud servers.
• Domain controller/DNS server is in the datacenter. 

Our office pc's DNS server is pointing to the datacenter domain controller/dns server. 

I setup the dns server according to this article. 
Configure Windows Server to use DNS Protection - Sophos Central Admin

I also setup our sophos xg firewall according to this article. 
Configure Sophos Firewall to use DNS Protection - Sophos Central Admin

I've tried going to some of the not allowed types of website that I setup to block using the keep it clean policy. But the websites still browse normally. I also setup marlboro.com to specifically block in the customized list filtering. The website is still viewable.

Any thoughts would be appreciated.