DNS domain blocking using UDP payload

I can confirm that I still see traffic to a blackhole_domain entry hitting a DoS_pool pool member after changing the profile.

one thing, can you try "return" after drop command?

  if {[matchclass $dname contains blackhole_domain]} {
    drop
    return
  }