Let's say we have this network setup:
PC > Firewall > DNS Server
I was under the impression that the PC would attempt to access the DNS server but the firewall would instantly block the request because it has noticed that the domain being requested is in its blacklist.
Reading online however, it seems the initial request to the DNS server is actually allowed but when the DNS server returns the IP address of the domain, it's blocked and unable to reach the PC.
Why is it done like this or was I right initially and have completely misunderstood something?