That's great. An alternative would be to use the CDN firewall in conjunction with blocking/controlling everything at the DNS level.
