A firewall has mechanisms to filter for all domains, however only covering a smaller number of generic, low-level matches and actions.