[Macha]

> Firewalls tend to support DNS, use it :)

So I did check and my firewall (the one built into my Unifi UDM), doesn't.

[dxld]

Sad to say I'm surprised the proprietary vendors are lagging behind here, but there should be no architectural reason you can't deploy a more reasonable firewall.