Comment by simonw

Yeah that's how I understand this too. The proxy lets any IP through and then filters based on the Host header.

It's difficult for a proxy to filter on DNS because you may have hundreds of hosts on a single IP, plus IPs can change frequently.