But that one is OK. DNS over HTTPS doesn't exist to circumvent enterprise content filtering (hence why you can hint you don't want it to run with a DNS entry, making it vulnerable to downgrade attacks).

Easier to make the orgs internal recursive resolver "does the right thing" than all clients, too.