topic Re: Regarding ADNSR Licensing and Region Support in Advanced DNS Security Discussions

Regarding ADNSR Licensing and Region Support

K.Kanbayashi — Fri, 30 Jan 2026 04:39:01 GMT

Attention: Global TPM team,

I have several questions about the Advanced DNS Security Resolver (ADNSR) licensing and region support.

In the activation documentation, I noticed the instruction “Select a Region where you want to deploy your product.”Advanced DNS Security Resolver Activation

However, I could not find any documentation describing which regions ADNSR supports, unlike other services such as Device Security (which requires choosing an SLS ingestion region) or AIRS (which lists supported regions).
During ADNSR activation, a deployment region must be selected, but there is no information about whether:

region choice affects ADNSR functionality,
some regions do not support ADNSR, or
the ADNSR region must match the Strata Logging Service (SLS) region.

Could you please clarify the following?

Does ADNSR have officially supported activation regions?
Are there any region‑specific feature limitations?
Should the ADNSR region match the SLS logging region?

Re: Regarding ADNSR Licensing and Region Support

olivia55mix — Thu, 04 Jun 2026 09:10:38 GMT

,
Hello..
Yes, ADNSR requires you to select a deployment region during activation, which indicates that the service is region-aware. However, Palo Alto Networks does not currently publish a dedicated "supported regions" list for ADNSR comparable to the documentation available for some other services. The activation workflow simply instructs administrators to select a region without describing a supported-region matrix.

Re: Regarding ADNSR Licensing and Region Support

CosminM — Thu, 04 Jun 2026 19:59:40 GMT

Hello,

The regions are referring to Palo Alto Networks regional cloud locations for each service. You can consult that worldwide distribution and services here: https://www.paloaltonetworks.com/products/regional-cloud-locations

Is mentioned that "As the Advanced DNS Security Resolver service sends all its logs to Palo Alto Networks cloud-based logging service, the tenant where you activate the license must be configured to use Strata Logging Service (formerly Cortex Data Lake). As this is a functional requirement, the Advanced DNS Security Resolver service includes SLS with 1 yr log retention." - https://docs.paloaltonetworks.com/dns-security/activation-and-onboarding/advanced-dns-security-prerequisites