Denylist not working for pikabu.ru and *.pikabu.ru (resolves to real IP even in clean profile)

Hi NextDNS team,

I am experiencing an issue where adding pikabu.ru to the Denylist does not block the domain. Even in a completely clean profile with all blocklists disabled and the Allowlist empty, the domain continues to resolve to its real IP address.

Steps to reproduce:

1. Created a brand new, clean NextDNS profile.
2. Disabled all Privacy & Security blocklists and ensured the Allowlist is completely empty.
3. Added the following rules to the Denylist:
   • pikabu.ru
   • *.pikabu.ru
   • d.pikabu.ru
4. Performed direct DNS queries to the profile’s DoH endpoint.

Expected behavior: The domain should resolve to 0.0.0.0 (or return NXDOMAIN / Refused) when blocked by the Denylist.

Actual behavior: The domain resolves to the real IP address 185.178.210.201.

Test results:

Bash

$ nslookup pikabu.ru 45.90.28.0
Server:  dns1.nextdns.io
Address:  45.90.28.0

Name:    pikabu.ru
Address: 185.178.210.201

Bash

$ curl -s "https://dns.nextdns.io/14e379?type=A&name=pikabu.ru"
{
  "Status": 0,
  "TC": false,
  "RD": true,
  "RA": true,
  "AD": false,
  "CD": false,
  "Question": [{"name": "pikabu.ru.", "type": 1}],
  "Answer": [{"name": "pikabu.ru.", "type": 1, "TTL": 274, "data": "185.178.210.201"}]
}

I also checked the Query Logs for this profile — requests to pikabu.ru appear, but they are not blocked by the Denylist rule.

Additional information:

• The behavior is the same across multiple profiles.
• All local DNS caches have been flushed.
• Allowlist is empty.
• My Denylist (via API) correctly shows the added rules as active.

It seems the Denylist rule is being ignored or overridden for this domain (and its subdomains), even though no other blocklists or exceptions are enabled. Could you please investigate what might be causing this? Possible factors could be CNAME handling, special internal processing of the apex domain, or another mechanism I’m not aware of.

If possible, I would appreciate it if you could ensure that pikabu.ru and all its subdomains can be properly blocked via user Denylist without any overrides.

Profile ID for reference: 14e379

Screenshots:

Logs:

 Denylist:

 Allowlist

Thank you very much for your time and assistance. I’m happy to provide any additional logs or run further tests if needed.

Best regards