For DNS name resolution feature, we reference allowed IPs in the ACL. IP's TTL may expire based on the DNS record, but it doesn't mean the existing connection should be dropped, only that new connections to that IP should not be allowed.

In an ideal world, I would like to store dnsNameID in the conntrack entry, so that the workflow would look like

dnsNameID := encode(dns-name)

acl.Action = allow-related && ct.label=dnsNameID

acl.Match = ip4.dst == <currently allowed ips> || ct.label == "dnsNameID"

(ct.label here is a very abstract thing)

That would allow dropping established connections when dnsName should not be allowed anymore.

Another option is just to always allow established connections for a given acl, so that we could just use a new acl.Action = allow-related+allow-established. This should be easier to implement, but won't allow breaking connections that should not be allowed anymore.

Let me know if you have more questions/better ideas to solve the problem.