As of SEP-V12 RU1 MP1, the firewall rule to block/allow a DNS Domain only allows the root/base domain name (ie: *.symantec.com). This rule would be more effective if it could block higher levels (examples:  *.liveupdate.symantec.com, or  *.espn.go.com).  Thanks.