We have an "Additional Default Domain Policy", applied at the Root of AD, that applies a suffix search order for DNS and it is "Filtered" to all "Authenticated Users". This works fine and we get the suffix search order list when we login.
We have another GPO called "DNS-Test" that we apply at a lower OU and filter so only the group "DNS-Test1" has the GPO applied. When I add my test account to that group and log in, I still get the original DNS suffix list.
I did try adding the actual system name I was testing on to the Filter List, rebooted the system and it worked, but it should work by Group name and not need a system name.
No blocking or Forcing of GPOs from above.
Dave