I had the same problem when upgrading from 9.1.11 to 10.0.7. I found out what "botnet-domains" were by looking at the CLI's "set" commands: SSH into Palo Alto device > then enter this: set cli pager off set cli terminal width 500 set cli scripting-mode on set cli config-output-format set configure show To get rid of the missing DNS license warning, you have to set allow/disable not only in the "default-paloalto-dns" line, but also on all other lines below "DNS Security" in Palo Alto's GUI.
... View more