diff --git a/tests/core/test_run_proxy.py b/tests/core/test_run_proxy.py
index d7083dc8..ee1d6ae3 100644
--- a/tests/core/test_run_proxy.py
+++ b/tests/core/test_run_proxy.py
@@ -129,7 +129,9 @@ def test_raw_socket_connect_to_a_host_name_warns(caplog, address, warns):
     assert bool(leaks(caplog)) is warns
 
 
-def test_core_frame_ends_the_walk(caplog):
+def test_core_frame_ends_the_walk(caplog, monkeypatch):
+    """A core lookup returns before the CDM host set is built, which a server does for every request it sends."""
+    monkeypatch.setattr(run_proxy, "cdm_hosts", lambda: pytest.fail("cdm_hosts() ran for a core lookup"))
     with caplog.at_level(logging.WARNING):
         source = "sys.audit('socket.getaddrinfo', 'vault.example', 443, 0, 0, 0)"
         run_as(os.path.join(run_proxy.CORE_DIR, "core", "vaults.py"), source)
diff --git a/unshackle/core/utils/run_proxy.py b/unshackle/core/utils/run_proxy.py
index f70f8c3b..33f2a1ad 100644
--- a/unshackle/core/utils/run_proxy.py
+++ b/unshackle/core/utils/run_proxy.py
@@ -190,10 +190,10 @@ def check(host: Any, frame: Optional[FrameType]) -> None:
     if isinstance(host, bytes):
         host = host.decode(errors="replace")
     host = str(host or "").lower().strip("[]")
-    if not host or is_local(host) or host in proxy_hosts or host in cdm_hosts():
+    if not host or is_local(host) or host in proxy_hosts:
         return
     found = find_service(frame, through_core=False)
-    if not found:
+    if not found or host in cdm_hosts():
         return
     service_frame, entry = found
     while frame is not None and frame is not service_frame: