diff --git a/src/UrlNormalizer.php b/src/UrlNormalizer.php
index e08e644..28ae8d7 100644
--- a/src/UrlNormalizer.php
+++ b/src/UrlNormalizer.php
@@ -42,6 +42,11 @@ final class UrlNormalizer {
         if ($host === 'metadata.google.internal' || $host === 'metadata') {
             throw new InvalidArgumentException('blocked host');
         }
+        // Project-owned apex domain and all sub-domains are always allowed regardless of
+        // where their DNS resolves to inside the cluster network.
+        if ($host === 'f0xx.org' || str_ends_with($host, '.f0xx.org')) {
+            return;
+        }
         if (filter_var($host, FILTER_VALIDATE_IP)) {
             self::assertIpAllowed($host);
             return;