A DNS firewall blocks known malicious domains, but the internal resolver still returns stale positive cache answers for one recently blacklisted host

The policy is correct now, yet the cached resolution path preserves yesterday's trust decision.