>Another approach is to disallow all DNS or only allow *.netflix.com for the TV. In my experience attempting to only allow certain domains is a game of whackamole where everyone in the house complains their stuff is broken because it needs undocumentedrandomdomain.com.

...not to mention that apps have random third party SDKs that are required, and might not work if you block those domains. A/B testing/feature flags SDKs, and DRMs (for provisioning keys) come to mind.