Global Protect on MacOS (TYPE65 dns queries)

dmgeurts — Fri, 07 Jun 2024 16:40:41 GMT

While troubleshooting a failing update on my own machine, I checked the DNS requests made by the Global Protect updater. And noticed that it's not making type A requests, but instead uses TYPE65 (aka HTTPS ordraft spec RFC 9460) requests. My internal DNS server don't have the option of hosting this type of record. The update fails as after two attempts per upstream DNS server the updater appears to give up.

Has anyone encountered anything like this?

TYPE65 is pre-standard but Apple has adopted this in MacOS. As for Global Protect (v6.2.2) I don't know if it or my OS is making it use a TYPE65 query. Fine if a system wants to try TYPE65 first, but for goodness sake, fall back to A/AAAA if it fails.

Another consequence of TYPE65 queries: https://discussions.apple.com/thread/252092927?sortBy=best

topic Global Protect on MacOS (TYPE65 dns queries) in GlobalProtect Discussions

Global Protect on MacOS (TYPE65 dns queries)