Traffic Deny due to DNS?

[Kenchh]

Hello,

I was given a chunk of IP addresses and domains/urls to update into an existing blacklist on the firewall.  I go to objects and create ip-netmask for ip addresses and FQDN objects for domains/urls. Some of the domains i received come in the form of url like "xxxxxx.xxx.com/*" and "https://xxxxxxxx.com/xxxx/xxxx.zip   " I decided to create an FQDN object for the domain of xxxxxx.xxx.com instead of xxxxxx.xxx.com/* because FQDN does not allow '/'. I did not create custom URL category for the long urls. When i committed and pushed the firewall changes to the device, some of the users who are accessing a work url that is not relevant to the ones i have blacklisted began to experience connectivity issue. 

The traffic logs flowing towards 1.1.1.1 and 8.8.8.8 seems to be deny and drop. 

After this failure, I created a custom URL category for those urls which i created FQDN object for earlier and attached in the service url category of the firewall blacklist rule.  The FQDN object i created for the url to block the domain is still present. The traffic towards the 1.1.1.1 and 8.8.8.8 seems to be resolved and the users are able to access their work-related url. 

I then removed the FQDN objects that i created to for the url, and the traffic is working. I

I removed both the FQDN object for the url and the custom url category, the DNS deny policy shows up again.

When i added the custom url category back onto the firewall rule, the DNS is resolved. 

May i know if anyone here has experienced similar issues and know what has happened that caused this. 

Is is because the DNS server could not resolve the FQDN object and results in this deny policy towards the DNS?

Thanks

[OtakarKlier]

Hello,

For some reason I see this from time to time as well. Something in windows is causing it or some program wants to use one of those servers for DNS. What I did was to only allow internal clients to get DNS from our internal servers. Then blocked the clients and servers, except for the dns servers, from going out to get DNS. This stop beaconing malware. I made this presentation for a conference if you care to watch it. 

https://youtu.be/ROIAYSEbTuo

Basically, force the systems to use your DNS, use a secure DNS provider, and block all other DNS requests, including dns over https and quic.

Regards,