In enterprise Google offered a tip to block youtube with the DNS;
If we dig in the KB’s text, we find that itselft that KB include nothing that can touch the DNS server, but digging farther show that;
The update 3185279 include that fix :
Addressed issue that causes Wildcard CNAME queries with Domain Name System Security Extensions (DNSSEC) enabled to not return Next Secure (NSEC) records.
Be sure to test out correctly if you need to make such tip after the update, as you may need to create a *.youtube.com’s zone to bypass the problem (or remove the update)