Last time I put a Roku behind DNS filtering it just started spamming it's logging server because it couldn't make contact. I ended up just letting it through instead of going through the hassle of spoofing a response to make it shut up.