Doesn’t work how? Does it block WASM (or are you querying a non-DNSSEC-signed record)?