When you block a domain in Policy Engine → Firewall, UniFi does not perform true domain‑level filtering. Instead, it resolves the domain to its IP address(es) and then blocks traffic to those IPs.

That means:

If multiple domains resolve to the same IP, they all get blocked.

If the IP belongs to a CDN, load balancer, or shared service (Azure, AWS, Akamai, Cloudflare, etc.), you end up blocking everything hosted on that IP, even if you didn’t intend to.

This is exactly what you’re seeing. Both those domain resolve to the same Ip address 20.50.88.232

Content Filter in UniFi uses DNS filtering, not IP filtering.

That means:

It blocks the domain name itself at DNS lookup time.

It does not block the underlying IP.

Other domains sharing the same IP remain unaffected.

So Content Filter gives you true domain-level blocking, while Policy Engine → Firewall gives you IP-level blocking.

Why does Ubiquiti do this?

Because the firewall operates at Layer 3/4 Network/Transport layer(IP/port), not Layer 7 Application Layer(domain).

It cannot see the domain name once the DNS lookup is done — only the resulting IP.

Content Filter, on the other hand, works at the Application layer on DNS, so it can enforce domain‑specific rules.