What could be the reason for the mystical substitution of domains?

Question

System administration

The system configuration is as follows:
1) Local DNS ( Acrylic DNS Proxy , on the same machine, 127.0.0.1) translates all domains to 127.0.0.1, except for whitelisted domains , they are listed in AcrylicHosts.txt.
2) All applications are proxified and access the internet via SOCKS (MicroTik on LAN) using Proxifier . Direct connection (through the gateway) is blocked and not possible.

And everything seems to work well, without failures, but some applications report the impossibility of connecting (with their servers, without specifying the address). In the Proxifier log, this is accompanied by lines like this:

[08.11 23:51:09] svchost.exe (2784) - www.mozilla.org resolve via 127.0.0.1:53 : DNS
[08.11 23:51:10] some_app.exe (2856) - www.mozilla.org(127.0.0.1):80 : direct connection

mozilla.org is a real example.
That is, these applications are accessing domains that were recently accessed from other places (this is a hypothesis). When such an application met for the first time, I first sinned against its developers. Like, what a game, random access to various popular sites. But when I came across other applications with similar behavior, I realized that it was not about them.

At first I tried to add these domains to the white list in the hope that such applications were checking something for themselves there. But each time the connection occurs to a new site. For example, clouds (of all brands), certificate authorities (the application goes through all of them), popular sites, etc.

Actually, the question is, what could be the matter?

Answer 1

In general, the reason was simple. DNS caching has nothing to do with it, only the cache in the Proxifier itself.

1. A certain soft1 resolves the forbidden address xxxxx1.com, which resolves to 127.0.0.1
   
2. A certain soft2 resolves the forbidden address yyyyy2.com, which also resolves to 127.0.0.1
   
3. Proxifier remembers that 127.0.0.1 is yyyyy2.com in order to somehow indicate calls to this address. Remembers the last successful resolution.
   
4. Next, soft1 wants to connect to 127.0.0.1 many times, and the log shows yyyyy2.com, although this domain has nothing to do with soft1.
   

Answer 2

Similar to DNS caching.
https://docs.microsoft.com/en-us/windows-server/ne... https: //my.keyweb.ru/knowledgebase.php
?action=disp...
decision? Specify the problem, perhaps they will suggest an alternative solution (firewall, for example).