Pls, Suggest me to writting allowlist url domain (https), I try to test but it doesn't work

2

With dotprefix you may not need the leading dot in the content, right ?

Another point : I am not sure this logic works because you may drop the tcp syn packet to 443 before you know the tls sni