Every router and network settings page has the same two boxes: Preferred DNS and Alternate DNS. The naming tells you that the second address is the backup, sitting and waiting if the first DNS doesn't do its job. So, one of my favorite DNS providers, Quad9, returns an NXDOMAIN response (basically "This doesn't exist") when it blocks something malicious. Well, it boils down to the difference between your Primary DNS and Alternate DNS and the features offered. The easiest "fix" is to just use the alternate DNS from a single DNS provider, rather than using two primary DNS addresses from two.