I have created an support case for this issue and its a known issue. Here is the important part from the support response: Root cause:- When dnsproxy cache is enabled, we always prepare the response from the cache (regardless if we have the records in cache already or we need to forward the request to a name sever first) During this process, dnsproxy does not check if the prepared DNS response is too big or not (default udp limit should be 512 bytes). So the DNS response prepared by dnsproxy could be dropped by other PAN FWs or network devices if the size is larger than the limit (512 or otherwise specified in EDNS) This problem usually happens with nested CNAME records and when cache is used due to dnsproxy's limited compression ability. As a workaround, one can 1. disable cache 2. add DNS proxy rule for this FQDN and not use cache 3. use EDNS (it allows larger UDP DNS) ... View more