dig init.ess.apple.com

So I turned on debug logging by log_groups({'rebind'}) and it looks blocked correctly:

[rebind][02941.10]   blocking blacklisted IP in RR 'mressext-axfrdnsvip.mr.if.apple.com. 43200  A       10.52.195.168'

Note that the module is sensitive even about records that might not get into the final answer sent to the client.

--Vladimir