They're all showing this...

DNS	www.google.com	{"domain_name":"www.google.com","rcode":5,"rdata":[]}	null	2026-07-16T13:22:02.000+00:00

The rejection reasons are all `null`. The policy I am using has egress configured as "Allow access to all destinations" so I would not be expecting www.google.com to be dropped. I'm assuming this indicates it is probably a bug.

You mentioned...

new AWS accounts with the simplified "Serverless compute and default storage" setup occasionally have account-level provisioning issues that support needs to fix on the backend.

I'm guessing without a support contract I'm a bit stuck with this if it is a bug 😅