[Arch-TK]

When I tried implementing something like this at some point, I found it impossible to actually implement reliably because DNS resolution changes all the time.

Unless you dynamically add rules as you resolve DNS requests and before responding to them, which seems painful to pull off.

Or do you point DNS records for the relevant domains at a proxy server, and have that server inspect SNI, look up the actual DNS records, and then tunnel the traffic? But this would rely on SNI which isn't a requirement (although it's probably always there...).