Help with WiFi SSID DNS issue "DNS-no-resp"

Hey all, hoping someone will be able to help with this one as I am stuck and spent ages looking around online for help and not getting anywhere.

So we have a small remote office with a single FortiGate 60F and a single 231F AP, its running with all its ports in a VLAN software switch and internal port 1 goes through a POE injector to the AP, simple as it gets.

The internal LAN is set as VLAN 0 and we run a Enterprise SSID with Radius etc which is all working fine (Bridge mode), now we wanted to add a Guest SSID so first of all created a Guest VLAN with VLAN ID 25 as below, its set to run a DHCP server and just use 1.1.1.1 and 8.8.8.8 for its DNS (Not using the system DNS)

New Guest SSID created (also bridge mode), VLAN 25 is specified in its config and a Firewall rule created to allow it out from Source 'Guest-VLAN' to Destination 'All'
Now when someone connects to this guest SSID we can see its dishing out an IP address and can see some traffic activity from users phone but users get the error "The Wi-Fi network “Guest” does not appear to be connected to the internet”.

Looking at the logs we keep seeing the below about DNS but no end of searching brings back anything relevant, cant see anything obvious I am missing, asking a user to check the phone we can see all correct IP info is coming from DHCP and setting the DNS on phone as 1.1.1.1 and 8.8.8.8 but they cant resolve anything... Help!