This task is achievable, albeit requiring a bit of effort. Wiresock would need to intercept and decode all DNS responses, subsequently maintaining dynamic AllowedIps/DisallowedIps tables. I concur that this could be an intriguing feature. I will endeavor to allocate some spare time to work on its implementation.