diff --git a/dnsproxy.go b/dnsproxy.go
index ef19aa4..c8bf3c7 100644
--- a/dnsproxy.go
+++ b/dnsproxy.go
@@ -174,7 +174,13 @@ func (proxy *DNSProxy) getIPByDomain(domain string) (string, error) {
 
 		if !proxy.isAllowedDomain(domain) {
 			go WriteLog(fmt.Sprintf("domain not allowed: %s", domain))
-			go WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: DNS resolution for domain %s was blocked. This domain is not in the list of allowed-endpoints.", domain))
+
+			// call to api.snapcraft.io is made by snapd in GITHUB_RUNNER
+			// so if it's not present in allowed-domains, traffic to it will get blocked
+			// since it is called by default service, we don't need to add it to annotations
+			if !strings.Contains(domain, "api.snapcraft.io") {
+				go WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: DNS resolution for domain %s was blocked. This domain is not in the list of allowed-endpoints.", domain))
+			}
 
 			// return an ip address, so calling process calls the ip address
 			// the call will be blocked by the firewall
diff --git a/firewall.go b/firewall.go
index 85c1af4..6033b65 100644
--- a/firewall.go
+++ b/firewall.go
@@ -227,10 +227,11 @@ func AddAuditRules(firewall *Firewall) error {
 		ipt = firewall.IPTables
 	}
 
-	// deny DNS on port 53
-	// TODO: Deny UDP overall?
-	//err = ipt.Append("filter", "OUTPUT", "-o", "eth0", "-p", "udp", "--dport", "53", "-j", "DROP")
-	err = ipt.Append("filter", "OUTPUT", "-o", "eth0", "-p", "udp", "-j", "DROP")
+	// deny DNS on port 53, else it interferes with DNS proxy
+	// Do not Deny UDP overall as developers may be using it, e.g. MS QUIC
+	// https://github.com/step-security/harden-runner/issues/112
+	err = ipt.Append("filter", "OUTPUT", "-o", "eth0", "-p", "udp", "--dport", "53", "-j", "DROP")
+	//err = ipt.Append("filter", "OUTPUT", "-o", "eth0", "-p", "udp", "-j", "DROP")
 	if err != nil {
 		return errors.Wrap(err, "failed to deny udp")
 	}
@@ -248,7 +249,7 @@ func AddAuditRules(firewall *Firewall) error {
 		return fmt.Errorf(fmt.Sprintf("ClearChain failed for DOCKER-USER: %v", err))
 	}
 
-	err = ipt.Append("filter", "DOCKER-USER", "-i", "docker0", "-p", "udp", "-j", "DROP")
+	err = ipt.Append("filter", "DOCKER-USER", "-i", "docker0", "-p", "udp", "--dport", "53", "-j", "DROP")
 
 	if err != nil {
 		return fmt.Errorf(fmt.Sprintf("failed to deny udp docker interface: %v", err))