What does a DNS-aware (FQDN) policy in Cilium allow?

Why this is the answer

FQDN policy lets you allow egress by domain name (toFQDNs), with Cilium watching DNS to map names to the IPs it then permits — useful for external APIs with changing addresses. It is not reverse-DNS ingress matching, not a way to block cluster DNS, and not DNS response rewriting.