Every outbound connection needs a DNS8 lookup. What prevents this from being abused for censorship?