[nickburns]

  A firewall (which must also host a resolver)

Is that true? Per what spec are you referring to?

[Zak]

ignoramous probably meant that in order to block access to all IP addresses that it has not recently resolved, the firewall must also host or communicate closely with a resolver. This is a tautology, not a spec.

[nickburns]

Ah, I definitely misread. Thanks!