A process comprising: storing a mapping cache containing hostname-to network address data records and unique identifiers identifying each data record; the data records including hostnames of hosts in association with network addresses and update information, particular update information associated with a particular hostname and a particular network address indicating a priority with which to update the particular network address; requesting, by a client, access to a hostname or network address; using a policy service to deny, filter, or allow access to the requested hostname or network address, wherein the hostname is used as a key to lookup an associated policy in a policy database to deny, filter, or allow the access to the requested hostname or network address, and wherein the hostname is resolved by referencing the mapping cache if the request is for accessing a network address; adding new hostname-to-network address data records, including respective hostnames and network addresses, to the mapping cache based on policy transactions of the policy service, the adding including: adding a particular hostname to the mapping cache, and associating the particular hostname with a respective network address by performing forward DNS resolution, if a client of the policy service is denied access to the particular hostname; characterized by adding a particular network address to the mapping cache, and associating the particular network address with a respective hostname by performing reverse DNS lookup, if a client of the policy service is denied access to the particular network address; obtaining a selection metric for selecting hosts based on their update information; prioritizing a subset of the hosts for update that meet the selection metric, where prioritizing the subset of the hosts for update is performed according to a predictive process, where the predictive process is configured to select the subset of the hosts based on frequency of change of network addresses of the hosts; updating the network addresses of the subset of the hosts, where the network addresses of the subset of the hosts are obtained by performing forward DNS resolution; updating the update information to reflect the updating of the network addresses of the subset of hosts. storing a mapping cache containing hostname-to network address data records and unique identifiers identifying each data record; the data records including hostnames of hosts in association with network addresses and update information, particular update information associated with a particular hostname and a particular network address indicating a priority with which to update the particular network address; requesting, by a client, access to a hostname or network address; using a policy service to deny, filter, or allow access to the requested hostname or network address, wherein the hostname is used as a key to lookup an associated policy in a policy database to deny, filter, or allow the access to the requested hostname or network address, and wherein the hostname is resolved by referencing the mapping cache if the request is for accessing a network address; adding new hostname-to-network address data records, including respective hostnames and network addresses, to the mapping cache based on policy transactions of the policy service, the adding including: adding a particular hostname to the mapping cache, and associating the particular hostname with a respective network address by performing forward DNS resolution, if a client of the policy service is denied access to the particular hostname; characterized by adding a particular network address to the mapping cache, and associating the particular network address with a respective hostname by performing reverse DNS lookup, if a client of the policy service is denied access to the particular network address; adding a particular hostname to the mapping cache, and associating the particular hostname with a respective network address by performing forward DNS resolution, if a client of the policy service is denied access to the particular hostname; characterized by adding a particular network address to the mapping cache, and associating the particular network address with a respective hostname by performing reverse DNS lookup, if a client of the policy service is denied access to the particular network address; obtaining a selection metric for selecting hosts based on their update information; prioritizing a subset of the hosts for update that meet the selection metric, where prioritizing the subset of the hosts for update is performed according to a predictive process, where the predictive process is configured to select the subset of the hosts based on frequency of change of network addresses of the hosts; updating the network addresses of the subset of the hosts, where the network addresses of the subset of the hosts are obtained by performing forward DNS resolution; updating the update information to reflect the updating of the network addresses of the subset of hosts.