Enabling Category-Based DNS filter with "Allow all" still redirects to portal ANY domain

I'm trying to setup dns blocklist (a-la pihole) on fgt60e v6.2.2

Wherever I enable "FortiGuard Category Based Filter" in DNS Filter, even with all the categories "Allowed", all my dns requests resolve to redirect portal ip(even something innocent like google.com)

I checked the config, and there are no blocked categories:

FGT60E # config dnsfilter profile

FGT60E (profile) # edit default

FGT60E (default) # show config dnsfilter profile   edit "default"     set comment "Default dns filtering."   next end

Is this some kind of bug? Did anyone have similar problem when empty/allowed dns filter still blocked everything?

Check the screenshot for GUI setup.