[stuartgreen]

i've seen problems with domain objects where there is an alias in the DNS record which some clients seem to resolve when the main / primary IP address cannot be resolved. The other problem with domain objects is the processing overhead. If you have a large amount of domain objects it will slow things down a fair bit while each is being resolved. I'd agree with northlandboy, get a dedicated web filtering solution. While check point does offer this as a feature - don't mistake it for a fully singing and dancing proxy!