This is the correct way to make exceptions for hostnames, not policy based routing on a router that merely translates hostnames to IPs, IPs which could be shared by 1000s of services and thus a much wider whitelist than you wanted. Nice