allowing a specific subdomain FQDN host

Could you verify your ruleset with the policy tester? 

https://community.sophos.com/kb/en-us/127477

results verified via policy tester,

     all levels of domain example.com are passed,    so even if   subdomain1.example.com  is what the FQDN is.    all others are accepted as well.   

all other domains are rejected.   

the desired outcome is only to pass a specific subdomain.   such as subdomain1.example.com  

Hi Heartwood ,

You may add a FQDN Group of the Subdomains you wish to allow. Now if you wish to deny the rest then this rule should apply as per the KB article mentioned.

Related KB https://community.sophos.com/kb/en-us/123035

Gotcha,    Perhaps I'm not understanding you.   I created a policy as stated in the article above.  I created a FQDN Host of the subdomain subdomain1.example.com 

But by this statement "Now if you wish to deny the rest then this rule should apply as per the KB article mentioned."  does that mean that all other subdomains should be blocked?

Because all subdomains are allowed still.   I'm unclear as to how to block the other subdomains that I don't want.

Such as allow subdomain1.example.com   but deny subdomain2.example.com   

Hi Heartwood ,

If you have added the subdomain 1 in the FQDN rule, it does not mean others will be blocked. It would mean that it would not be allowed in that rule and for the ones that does not match the rule , it will check the other rules set from top to bottom priority. 

Could you check using Packet capture if the subdomain 2 is going through the same rule as FQDN ?

Hi Heartwood ,

If you have added the subdomain 1 in the FQDN rule, it does not mean others will be blocked. It would mean that it would not be allowed in that rule and for the ones that does not match the rule , it will check the other rules set from top to bottom priority. 

Could you check using Packet capture if the subdomain 2 is going through the same rule as FQDN ?