A DNS Firewall policy must remain enforceable when clients try to use arbitrary external DNS resolvers directly. What additional control is required?

1. Assume DNS Firewall automatically inspects all encrypted traffic to every external resolver.
2. Increase the DNS Firewall rule priority number to rewrite all VPC routes.
3. Delete VPC Flow Logs because they conflict with DNS policy evaluation.
4. Govern alternate DNS egress paths so clients cannot bypass the intended resolver policy.