For agent sandboxes needing domain-based #egress filtering on outbound traffic «without» TLS termination, #DiscrimiNAT OTF offers policy discovery, and SNI spoofing prevention. DNS spoofing and abuse of shared IPs on CDNs won't work thru it. Search in cloud console: DiscrimiNAT