each request goes to their private DNS - you can see it's always hitting googledotcom. Why the fuck are trackers only hitting the Google domain with no verbose queries? But later when I turned off private DNS, all the trackers are being blocked effectively with proper long queries showing.