> It doesn't need to have every cname in it. The cname resolves to the actual "bad" domain, which should be in your list already. That doesn't help if dnsmasq

> It doesn't need to have every cname in it. The cname resolves to the actual "bad" domain, which should be in your list already. That doesn't help if dnsmasq only checks the incoming request against the list, and not the whole cname chain of the result.