Doesn’t LS let you block internet access per app per domain? At that level of control why would dns resolution bypass matter when I can still block the app from talking to any arbitrary IP?