What
Block rules in sandbox.network.deniedDomains are now checked against a standard form of the host as well as the host exactly as written. The standard form smooths out different ways of writing an IP address and a trailing dot. When a connection is blocked, the reason names both forms.
The sandbox's network relay (the SOCKS proxy that carries sandboxed network traffic) now answers "connection not allowed" when a rule blocks a connection, instead of "host unreachable".
Why
A blocked host can no longer be reached just by writing its address differently, and a blocked connection is now reported as blocked rather than as a host that could not be found.
Names in the bundlesandbox.network.deniedDomains
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
Exactly which alternative spellings are recognised is not fully settled.