https://live.paloaltonetworks.com/t5/next-generation-firewall/pan-275077-is-this-bug-still-affected-in-11-1-10-h1/m-p/1252224#M6840 <P>I am currently observing behavior where both Sinkhole and Alert actions are being logged simultaneously for the same malicious domain.</P> <P>&nbsp;</P> <P>When performing an nslookup from the affected endpoint, the domain resolves correctly to the Sinkhole IP, which indicates that the sinkhole functionality is working as expected. However, I continue to see “Alert” logs being generated.</P> <P>&nbsp;</P> <P>I have also attempted increasing the DNS timeout to 200 ms, but the behavior persists.</P> <P>&nbsp;</P> <P>Could anyone please confirm if PAN-275077 is still present in recent 11.1.0-h1 PAN-OS versions, or if this issue is resurfacing under a different bug ID?</P> Wed, 15 Apr 2026 10:44:05 GMT V.Sambath 2026-04-15T10:44:05Z https://live.paloaltonetworks.com/t5/next-generation-firewall/pan-275077-is-this-bug-still-affected-in-11-1-10-h1/m-p/1252224#M6840 <P>I am currently observing behavior where both Sinkhole and Alert actions are being logged simultaneously for the same malicious domain.</P> <P>&nbsp;</P> <P>When performing an nslookup from the affected endpoint, the domain resolves correctly to the Sinkhole IP, which indicates that the sinkhole functionality is working as expected. However, I continue to see “Alert” logs being generated.</P> <P>&nbsp;</P> <P>I have also attempted increasing the DNS timeout to 200 ms, but the behavior persists.</P> <P>&nbsp;</P> <P>Could anyone please confirm if PAN-275077 is still present in recent 11.1.0-h1 PAN-OS versions, or if this issue is resurfacing under a different bug ID?</P> Wed, 15 Apr 2026 10:44:05 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/pan-275077-is-this-bug-still-affected-in-11-1-10-h1/m-p/1252224#M6840 V.Sambath 2026-04-15T10:44:05Z