We have url_preview_ip_range_blacklist, but no equivalent for federation requests. The attack surface is of course much smaller, but I still don't like the idea of my synapse going and hitting random HTTP servers within my firewall because someone pointed a DNS record at them. In particular, it's currently possible to make synapse send requests back to itself with a DNS record which resolves to 127.0.0.1