Quite a simple question but the solution not so 
Running the Android DO Kiosk mode, works really well except for one aspect. We are trying to build a network whitelist that will only allow the device outgoing/incoming to internal DC and data collection servers (completed), but cannot find anywhere the definitive dns named server(s) to whitelist for the google play store and Mass360 to receive updates and enroll etc. We see drops in the logs etc and can build it based on ip address, but I'm reluctant to have that as a solution for obvious reasons. Throwing this out there to see if any others have had the same challenge

kindest regards