Need to Create custom signature for the nxdomain

[MP18]

I need to create custom signature for the dns traffic.

what is want is if dns query is about nxdomain then PA should drop it.

Is this possible to config in PA?

[Rajesh12]

Is your ask is to block DNS query traffic of specific hostname (nslookup hostname)? If yes, then it is possible to do it with PA. Let me know if my understanding is correct.

[MP18]

I have name server and I see so many queries to the domain names that do not exist.

So i need to know if i can create custom signature for nxdomains

[Rajesh12 · Accepted solution]

Ah I see. PA do have capability of blocking DNS queries for given name. But I don't think PA have capability of blocking nxdomain as PA will not have any prior knowledge of existent or non-existent status.

[MP18]

Thanks for answering my question.