Or why not just serve it from www.domain.com/.well-known so we only have one thing to block. :p