Comment by ProllyInfamous

I have noticed this on my local Pi-Hole — that Little Snitch denials still result in a DNS resolution (i.e. requested hostname still has IP resolved).

To every person I've watched DENY a connection via LittleSnitch popup, I have been told "you don't know what you're talking about — why would it behave like that?!"

It just does. You need your own network DNS and firewalls, and you need to know how to use them.