Hagezi Blocklist Not Available?

[OPNenthu]

Then OPNsense should go upstream for all its DNS requests, instead of using the local Unbound DNS and its blocklists.

You can also not use any DoH lists in the default Unbound policy and instead configure that only on source-net specific policies.  Multiple ways to skin this cat.

I do also prefer my firewall go through Unbound, but I use DoT upstreams because ISPs in my country are not legally obligated to not sell customer data, and because Quad9 has up-to-date malware and threat intelligence that I can't otherwise get for free.