>That's why you block port 53 in both UDP and TCP so nothing can bypass it.

Already done...something is still sneaking through...or cloudflares test is unreliable (or my iptables rules are wrong lol)