topic dnsproxy failures in General Topics

dnsproxy failures

azwicker — Thu, 21 Mar 2013 10:02:41 GMT

System log fills with messages like "Failed to resolve domain name:defrxpwgklm.capco.com after trying all attempts to name server(s): 8.8.4.4 194.25.0.68". DNS without dnsproxy is working. Can i restart the dnsproxy to fix this issue?

The messages are appearing after some threats of type "Suspicious DNS Query".

Re: dnsproxy failures

Retired Member — Fri, 29 Mar 2013 19:55:31 GMT

Which version Panos you use ?

you use dns proxy on PaloAlto ? you tried to restart ,did it solve ?

Re: dnsproxy failures

mikand — Fri, 29 Mar 2013 21:43:28 GMT

I wouldnt be suprised if defrxpwgklm.capco.com is a malware url, I have seen similar design of the subdomain part which previously have been classified as malware-related.

Also currently it doesnt seem to resolve at all:

;; QUESTION SECTION:

;defrxpwgklm.capco.com. IN ANY

;; AUTHORITY SECTION:

capco.com. 3600 IN SOA ns1.netnames.net. hostmaster.net

names.net. 2013032800 10800 1800 3600000 21600

Re: dnsproxy failures

phrdlicka — Tue, 17 May 2016 08:11:05 GMT

Old thread, but as it is still visible - from description it seems to be matching scenario described in following KB article:

https://live.paloaltonetworks.com/t5/Management-Articles/Blocking-Suspicious-DNS-Queries-with-DNS-Proxy-Enabled/ta-p/66037