DNS policies
Block domain lookups or return a custom IPv4 address for office clients.
Policy configuration
- Open Private Connect and select Manage interconnect for the office.
- Select DNS policies.
- Select Add DNS rule.
- Enter a lowercase domain without a wildcard or trailing dot.
- Choose an action and, for an address rule, the response IPv4 address.
- Select Save interconnect.
Each interconnect supports up to 128 rules. Saving a policy briefly interrupts gateway connections and resets analytics counters.
Domain matches
A rule matches its domain and all subdomains. The most specific domain wins.
For example, block example.com with NXDOMAIN, then allow allowed.example.com. Queries for www.example.com are blocked; allowed.example.com and its subdomains use normal DNS resolution. anotherexample.com matches neither rule.
Response actions
| Action | Result |
|---|---|
| Allow upstream response | Use the configured DNS resolver's response. |
| Return NXDOMAIN | Report that the domain does not exist. |
| Refuse query | Return DNS response code REFUSED. |
| Return IPv4 address | Return a 60-second A record for A or ANY queries. |
An address rule returns an empty successful response for other record types. Unmatched domains use normal resolution. An upstream timeout or error returns SERVFAIL.
DNS transport
Policies apply to DNS requests sent through the tunnel on TCP or UDP port 53, even when a client addresses another resolver. Forwarded traffic on port 853 is blocked.
DNS over HTTPS can bypass these policies. Use device or browser controls if you need to prevent it.
Custom answers do not preserve DNSSEC validation. Returning a private address does not make that destination reachable: Private Connect blocks private and reserved destinations.
DNS activity
Open Analytics to inspect recent query names, response codes, actions, and answers. A DNS lookup shows name resolution; use destination traffic to investigate subsequent connections.
See analytics limits.