I think this is an issue since #56 - if an agent makes a network request to a blocked domain (say google.com), we don't see the blocked domain in Hubble anymore, because it was the request to kube-dns which was blocked, not a request to google.com.
This makes curating allowDomain lists harder.