If you are getting a certificate warning then the dns lookup is succeeding but the (tcp) packets are under inspection (decrypted by the firewall and then re-enc

If you are getting a certificate warning then the dns lookup is succeeding but the (tcp) packets are under inspection (decrypted by the firewall and then re-encrypted). DoH only encrypts the DNS name resolution, which is only one method used by orgs to inspect traffic. To solve this you need a VPN so that the packets are encrypted by something in addition to TLS