...why wouldn't it be possible? iOS has application sandboxing, just drop all DNS requests for the webview that's outside a developer-defined namespace. I'm sure someone at Apple could find a better way to implement it, but we shouldn't accept lame excuses like this. Apple has 200 billion dollars in cash, this is not an advanced problem space.