topic Re: Brand new domain go to sinkhole in Prisma Access Cloud Management Discussions

Brand new domain go to sinkhole

R.Park — Wed, 19 Mar 2025 12:46:36 GMT

Hello. I am currently using Prisma GlobalProtect and am aware of the EOS notice.

I recently purchased a new domain (.ai), set it up on AWS, and began development. However, when connecting Prisma GlobalProtect, access to the domain fails. Upon checking with `nslookup`, all responses are as follows:

Server: 10.1.133.1

Address: 10.1.133.1#53

Non-authoritative answer:

BRANDNEWDOMAIN.ai canonical name = sinkhole.paloaltonetworks.com.

Could you advise on how to resolve this issue?
I attempted to create a support ticket, but only SSO errors appeared, preventing me from submitting the ticket.

Thank you.

Re: Brand new domain go to sinkhole

JayGolf — Thu, 20 Mar 2025 17:50:48 GMT

Hi @Robert ,

If you enter your domain into urlftilering test a site, what does it show?

Re: Brand new domain go to sinkhole

R.Park — Fri, 21 Mar 2025 00:30:05 GMT

Hello @JayGolf

Thank you for your kindness.

I've contacted the site yesterday, but request is rejected.

Thanks again for your URL re-categorization request. Unfortunately, we are unable to connect to "DOMAIN[.]ai" to classify its contents because the site or page has been taken down, or the page contents are not being delivered to us for some other technical reason. Until we can access this site or page, its current categorization will not change

Currently, I've contacted paloalto with support ticket to solve the problem.

Re: Brand new domain go to sinkhole

LaurenceNG — Tue, 29 Apr 2025 15:05:30 GMT

You will need to create a DNS security exception for the domain, by going to the DNS security TAB from the drop down, select your policy and then add it into the overrides, only do this if you are sure though, I would suggest that possibly once that is done the domain might get caught by URL filtering as well, so you may need an exception there as well.

Hope this helps!

Re: Brand new domain go to sinkhole

R.Park — Wed, 30 Apr 2025 00:43:55 GMT

@LaurenceNG Thank you for your help.

It was done, with DNS security exception for the domain.

At that time, I did use it with default policy, so I cannot add exceptions to it. 😉

I really appreciate you and your help.