Comment by throwaway2048

DNS is generally looked up once, on ruleset initalization, there is no way a firewall is going to look up DNS every single time a rule is referenced. Since DNS here is changing constantly, this is unhelpful.