10-08-2025 10:14 AM - edited 10-10-2025 09:53 AM
After several hours of debugging, I finally found the root cause of this problem.
DNSSEC validation is enabled by default on a BIND DNS server (dnssec-validation auto).
In our case, the DNS server is configured as a resolver, so every DNS request will query the root DNS server for the corresponding top-level DNS servers etc. All these requests are intercepted by Palo's sinkhole feature. Therefore, DNSSEC validation fails and does not return an answer.
To mitigate this problem, there are several options:
1.) Disable DNSSEC validation on the Bind server.
2.) Instead of using the resolver, configure your DNS server to forward to an external DNS server (e.g. Google).
3.) Disable the sinkhole feature on all root and top-level DNS servers, because DNSSEC is primarily used at this level and is not very popular in user domains.
I used option 3 and generated an IP list of all root and top-level DNS servers (internic.net/domain/root.zone) using PowerShell. This list was configured as an EDL in a firewall rule as the destination with the DNS security feature disabled.
