In my case I added override rules in my opnsense router so that archive.is .ph .today .md are all resolved by a different nameserver.
Disabling DOH can appear to fix it only in the happenstance case that the fallback plain dns doesn't end up using cloudflare, or doesn't use it first.