Thank you for flagging this.

We'll try to reproduce this first and then investigate.

Any updates?

I think it is an issue with your policy. Depending on where around the world you are loading google.com might try to redirect you to a local domain that also needs whitelisting. For example I am in Germany and for me when i type "google.com" I end up on "www.google.de" so I need to add that too. Also Google will redirect you to the https version of that page so you always need to add both http:// and https:// domains to the list. 

I am in the USA, so google.com should work fine for a policy.

You may be on to something with the https though. I was only using google as an example. I am actually trying to unblock a local server such as http://server.domain.local and that is not working either.

have you checked if your server is not doing any redirects internally to other subdomains or if it uses some SSO flow that goes to external domains for login?

Try to get example.com going as this domain has no redirects and no attempts to change schema etc.