[Environment]
Knox version*: 2.9
Model number: SM-N950F
Android version: 7.1.1
Google Chrome version: 66.0.3359.158

[Summary]  
The latest Chrome version (66.0.3359.158) is using the Chromium DNS-resolution method, that can bypass our addDomainFilterRules API. You need to force Chrome to use the system’s DNS-resolution. This is done by using port 53 as an argument for the FirewallRule.

[Resolution] - 

To correct this on SDS IAM&EMM, please follow the steps below:

1 - Access Endpoints Policies >Samsung Knox Device Settings> Firewall Settings > Knox 2.6+
2 - Find policy Deny Rules, then click on Add
3 - Fill the fields as:

Package Name: com.android.chrome
IP address/range: *
Port/port range: 53
Applied ports: All
Network interface: All

This is illustrated in the example below
​​