A newly blocked domain remains reachable through stale resolver cache state during a failover rehearsal

The control is correct now while caches preserve yesterday's trust decision. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.