We have issues where CNAME's that don't display a website, such as a redirect for email services like Sendgrid, have a category of 'landing page' which we block. This results in inacurate blocks, as the underlying service is legitimate, but the CNAME has a different category.