DNS issue due to Proxy-Avoidance-and-Anonymizers software

[AmitChauhan]

Hello All,

We observered a Sev 1 issue last week which was related to internet slowness that impacted large number of users . During the issue start time , we observed DNS traffic blocks between our DNS server and URL services.disconnect.me ( Palo Alto firewall was flagging it as Threat)

Regarding this URL – this is related to a browser extension "disconnect me" which is not malicious , this is used to avoid tracking on the internet.

URL: services.disconnect.me

Categories: Proxy-Avoidance-and-Anonymizers

Risk Level: Low-Risk

my setup is : client -> internal dns server -> dnsproxy(PAN firewall) -> external dns server

Though, the issue was fixed after removing DNS security from my antispyware profile which was called into the DNS rule.

I'm trying to understand if this URL/extension or similar Ad blocking/Anti-tracking extension can impact/corrupt the DNS traffic which can eventually choke the network.