You write that this is not for a “determined attacker” and you are absolutely right. You also point out that it’s a great compliment to another layer of security at a proxy or gateway and you are absolutely right.

Like most security solutions, it’s just a piece of the puzzle, and we’re trying to make it as easy as can be. I’m not aware of anything that provides this level of control or insight into DNS today. Note we let you block or whitelist individual domains too, if categories are too broad.

Anyways, thanks for the analysis and writeup, I love getting the feedback.