Oct 7, 2026, 1:15 PM@thedarktangent maybe I misunderstood the problem. If you don’t want resolution you set RPZ for cdn.network.com to resolve to a blocked landing page IP, return NXDOMAIN, etc
If you’re looking for this to also involve packet filtering, yes my option doesn’t do that. But if you can enforce DNS through your RPZ resolver, no one except those in an “allow” policy will be able to resolve an IP for that name.
