Bypass DNS Security Subscriptions Services (PAN-OS 10.0 and later)

Table of Contents

Bypass DNS Security Subscriptions Services (PAN-OS 10.0 and later)

Log in to the NGFW.
Configure the DNS Security signature policy settings to bypass DNS Security queries.
1. Select ObjectsSecurity ProfilesAnti-Spyware.
2. Select the profile containing your active DNS Security policy settings.
3. Select the DNS Policies tab.
4. For each DNS category, set the log severity to none, the policy action to allow, and packet capture to disable. In the following, the DNS Security categories have been configured to bypass DNS Security queries.
Select DNS Exceptions and remove all DNS Domain/FQDN Allow List entries.
Click OK to save the Anti-Spyware profile.

Alternatively, if you want to exempt only specific trusted domains rather than bypassing all DNS Security inspection, you can use the bypass action on domain EDLs (PAN-OS 12.2.2 and later). In the DNS Policies tab, add a domain EDL under External Dynamic Lists and set the Policy Action to bypass. This skips DNS Security inspection for matching domains without generating log entries, while maintaining inspection for all other traffic.

Advanced DNS Security

Bypass DNS Security Subscriptions Services (PAN-OS 10.0 and later)

Advanced DNS Security

Bypass DNS Security Subscriptions Services (PAN-OS 10.0 and later)

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Network Security

Endpoints

Visibility & Monitoring

Best Practices