A DNS-based security control blocks new lookups while stale resolver cache still serves the previous answer for the same host during a failover rehearsal

The control is correct now and one cache layer still trusts yesterday. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.