@thure How does your resolver respond to a request for a blocked domain? I wouldn’t expect iOS to try again after getting an NXDOMAIN, but I could see that behavior for NOERROR or REFUSED (and obviously for SERVFAIL).