I think an allow-based DNS RPZ policy could potentially address this. If you could define the names that clients ought to talk to. It maybe a moving target, but

I think an allow-based DNS RPZ policy could potentially address this. If you could define the names that clients ought to talk to. It maybe a moving target, but worth trying. https://tools.ietf.org/id/draft-vixie-dnsop-dns-rpz-00.html https://tools.ietf.org/id/draft-vixie-dnsop-dns-rpz-00.html https://lists.redbarn.org/pipermail/dnsfirewalls/2013-March/000194.html https://lists.redbarn.org/pipermail/dnsfirewalls/2013-March/...