First, you should know that Sophos has excellent pre-sales engineers that can quickly answer this kind of question. More importantly, you should be working with a reseller that can get questions through to those engineers when the reseller's engineers can't answer them.
I have the same issue. My reseller does not even respond to emails, so not a good reputation for SOPHOS.
I followed the DNS best practice already but something with the DNS resolution was wrong from the very beginning. What ever I did, DNS host names were not resolved. I added then "nameserver 127.0.0.1" to resolve.conf, since then I can use DNS host names in the definitions group.
The webfiltering still does not work because of the errors above.
Yes, I have worked through DNS best practice. Adding the "internal (Network)" does not change anything. Internal clients are resolving against srv01.oh.local which is the DC.