DNS Filtering Is Configured But Does Not Take Effect

The control action is set to block for the DNS category to which a domain name belongs, but users can still access this domain name.

Symptom

The domain name is added to a predefined DNS category, and the control action is set to block for the category. However, users can still access the domain name.

Figure 1 shows typical networking.

Figure 1 Networking diagram of DNS filtering

Procedure

Choose Monitor > Logs > System Log List to view logs indicating that the access to the domain name is permitted.

Possible causes and the troubleshooting procedure are as follows:

The domain name matches a security policy with a higher priority.
Choose Policy > Security Policy > Security Policy and check whether the domain name matches a security policy with a higher priority.
- If yes, refine the match conditions of security policies or adjust the priorities of security policies so that the domain name can match the desired security policy.
- If no, go to the next step.
The domain name is added to a whitelist.
Choose Object > Security Profiles > DNS Filtering. In DNS Filtering Profile, check whether the whitelist in the existing profile contains the domain name.
- If yes, delete the domain name from the whitelist.
- If no, go to the next step.
The domain name matches other user-defined categories with user-defined rules, and the action is permit. Check the following possible causes:
1. Other user-defined rules have higher priorities. The priority in descending order is as follows: Exact matching > suffix matching > prefix matching > keyword matching.
2. If the matching method is the same, other user-defined rules are longer. The final matching result displays the category with the longest rule.
3. If rules have the same length, the action mode is loose mode.

Choose Monitor > Logs > System Log List to verify that this domain name has no relevant logs.

Possible causes and the troubleshooting procedure are as follows:

The domain name matches a security policy with a higher priority, and the security policy does not reference the DNS filtering profile.
Choose Policy > Security Policy > Security Policy and check whether the domain name matches a security policy with a higher priority.
- If yes, refine the match conditions of security policies or adjust the priorities of security policies so that the domain name can match the desired security policy. You can also reference the DNS filtering profile in the security policy.
- If no, go to the next step.
The modified DNS filtering profile is not committed for compilation.
If the modified DNS filtering profile is not committed for compilation, click Commit for compilation.

Committing the configurations of the blacklist, whitelist, user-defined categories, or predefined categories leads to configuration recompilation, which deteriorates the performance consequently. You are advised to commit configurations at a time after all modifications are complete.