I don’t know exactly what action the IPFire team takes when they specify “allowed” for group46.sites.hscoscdn40.net, but I’m afraid the answer is yes.
When you add a domain in your “custom allowed list” this domain bypasses all the others knot-resolver rules