>but our retrospective review identified other cases of external DNS access that it did not flag at the expected severity.

How after all this time have they not just spun up a DNS server inside the sandbox?

I detest that the stupidest people on the planet are the ones in charge of this stuff.