A DNS sinkhole activates for new queries (DNS Resolution Failure)

The block policy is correct now and resolver memory still reflects the old decision. The service still works through the primary path, but one dependency only fails when the old component is finally drained away. The primary component still serves traffic, yet the retirement exercise exposes a latent dependency on what is being removed.