DNS proxy for splunk cloud net rule still denied

I have set up my azure FW for DNS proxy and changed the v-nets dns to the private IP of the FW.

I have the firewall pointing to custom dns servers.

I created a FW rule to allow port 9997 to our splunk cloud instance from any IP.

clients are still denied 

On a VM I can verify its using the FW IP, and I see dns queries in the logs.

I'm not sure what I'm missing.