I finally set up the packet capture that I should have done months ago.
d'oh! It's looks like out block code is case sensitive.
We didn't see this, because we convert the data to all-lowercase before we save it.
We need to swap the order of those functions...
I know that I tested this in the past, so this bug was introduced in some changes we made.
More darkly humorous: It's actually impossible to enter uppercase characters into the domain blacklist.