ferm in stretch now ships a systemd unit. That's great, but it breaks any rule using @resolve (i.e. any host since 10_prometheus-node-exporter is everywhere):
The unit uses
Wants=network-pre.target Before=network-pre.target shutdown.target
network-pre.target is explicitly defined to run prior to network setup:
This passive target unit may be pulled in by services that want to run before any network is set up, for example for the purpose of setting up a firewall. All network management software orders itself after this target, but does not pull it in.
The correct fix would be to setup an early service which sets up the defaultrules and a second service which has "Wants: nss-lookup.target" which parses the locally configured rules.