Thanks, I'll look more into this.

With little snitch, I use "notify and I select allow or deny". And it works for ip addresses (4 and 6) as well as domains. It's a powerful system, but if I can get similar with domain allowlisting, that would be a worthwhile improvement.