Can't use LTD (lighttpd issue). Can use Query Log - Show all
apt-get update on the client gives expected results.
msn.com in browser gives one query (A) OK. I whitelisted msn.com. Next domain in chain is blocked.
When I remove msn.com from the whitelist it is Blocked (gravity, CNAME)