it needs to be significantly more than just hostname / IP / DNS. a common attack i see for exfil behind FW is to sign up for a free account on heroku, fastly,

it needs to be significantly more than just hostname / IP / DNS. a common attack i see for exfil behind FW is to sign up for a free account on heroku, fastly, cloudflare, etc so that your outbound destination is to a "good" IP. you can resolve api.legitimatecompany.example and then send the actual request to that IP (which is a CDN), with an encrypted Host: header of your own endpoint, for example.