topic Re: Encrypted-DNS False Positive Heads Up in General Topics

Encrypted-DNS False Positive Heads Up

BPry — Thu, 06 Apr 2023 02:18:10 GMT

Presently 20230406.20033 and earlier updates are presenting a large number of false positive categorizations for encrypted-dns. This includes several domains from Bitwarden, YouTube, Google, Microsoft, Spotify, and many many others. If you have encrypted-dns set to block you may get reports of many services not functioning properly.

Re: Encrypted-DNS False Positive Heads Up

securehops — Thu, 06 Apr 2023 16:12:16 GMT

Any updates on a resolution for this?

Re: Encrypted-DNS False Positive Heads Up

BPry — Thu, 06 Apr 2023 17:02:23 GMT

@securehops,

This is said to be addressed, however someone of the domains falsely categorized last night are still being corrected and reported. If you haven't done so already and you're affected by this, ensure that you've cleared the cache on your firewall to verify that you have the current categorizations. I've listed the command below.

I've sent three updates with a handful of domains still as of this morning that needed to be corrected, but the majority appear to be categorized properly now.

clear url-cache all

Re: Encrypted-DNS False Positive Heads Up

securehops — Thu, 06 Apr 2023 18:05:58 GMT

Thansk @BPry. I'm also still seeing some of the domains being categorized as Encrypted DNS (based of the Test A Site url). Do you have an official link where this says it was addressed? I opened a priority ticket last night but still waiting on a response.

Re: Encrypted-DNS False Positive Heads Up

BPry — Thu, 06 Apr 2023 18:27:07 GMT

@securehops,

I don't have any acknowledgement that it was addressed officially by PAN outside of an update I have on a TAC ticket earlier this morning. A lot of the false positives that I gave as examples were addressed earlier this morning, but not everything. It looks like they attempted to clear things up but more minor domains may need to be individually reported.

Re: Encrypted-DNS False Positive Heads Up

securehops — Fri, 07 Apr 2023 00:27:18 GMT

Thanks @BPry , wanted to make sure I didn't miss something official!

Re: Encrypted-DNS False Positive Heads Up

emyl_79 — Fri, 14 Apr 2023 06:54:58 GMT

Looks like the issue is solved to me as of ~9PM of 12th April (CEST time).