DNS domain blocking using UDP payload

I ran into the same issue. Here is something that might work.

It was taken from

https://devcentral.f5.com/wiki/iRules.fast_DNS.ashx

when CLIENT_ACCEPTED {
    binary scan [UDP::payload] H4@12A*@12H* id dname question
     set dname [string tolower [getfield $dname \x00 1 ] ]
    switch -glob $dname {
       "\x03www\x06google\x03com" {
          log local0. "This matches www.google.com"
          drop
       }
   }   
}

I hope this helps

-=Bhattman=-