Seems like your setup should work. But no luck.
Even tried wire wiremat :
“Note: The module (and kres) expects domain names in wire format, not textual representation. So each label in
name is prefixed with its length, e.g. “example.com” equals to “\7example\3com”. You can use convenience
function todname(’example.com’) for automatic conversion.”
Tried both rpz file which than stops all addresses with dns conf error. And direct policy.add(policy.suffix(policy.DENY, {’\6badboy\2cz’})) type with no success.