https://support.mozilla.org/en-US/kb/canary-domain-use-appli..., also if you can block it this easily so can the government. The difference with a canary domain is that mozilla can disable it if its misused.
2) to implement this canary, you have to break DNSSEC on entire .net root domain. Great.