>
    Strata Copilot
    PAN-OS
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. DNS
    4. Configure a DNS Proxy Object
    5. PAN-OS
    Download PDF
    Next-Generation Firewall

    PAN-OS

    Table of Contents

    PAN-OS

    Create a DNS Proxy Object for PAN-OS.
    Create a DNS proxy object for PAN-OS.
    1. Configure the basic settings for a DNS Proxy object.
      1. Select NetworkDNS Proxy and Add a new object.
      2. Verify that Enable is selected.
      3. Enter a Name for the object.
      4. For Location, select the virtual system to which the object applies. If you select Shared, you must specify at least a Primary DNS server address, and optionally a Secondary address.
      5. If you selected a virtual system, for Server Profile, select a DNS Server profile or else click DNS Server Profile to configure a new profile. See Configure a DNS Server Profile.
      6. For Inheritance Source, select a source from which to inherit default DNS server settings. The default is None.
      7. For Interface, click Add and specify the interfaces to which the DNS Proxy object applies.
        • If you use the DNS Proxy object for performing DNS lookups, an interface is required. The firewall will listen for DNS requests on this interface, and then proxy them.
        • If you use the DNS Proxy object for a service route, the interface is optional.
    2. (Optional) Specify DNS Proxy rules.
      1. On the DNS Proxy Rules tab, Add a Name for the rule.
      2. Turn on caching of domains resolved by this mapping if you want the firewall to cache the resolved domains.
      3. For Domain Name, Add one or more domains, one entry per row, to which the firewall compares FQDN queries. If a query matches one of the domains in the rule, the query is sent to one of the following servers to be resolved (depending on what you configured in the prior step):
        • The Primary or Secondary DNS Server directly specified for this proxy object.
        • The Primary or Secondary DNS Server specified in the DNS Server profile for this proxy object.
        DNS Proxy Rule and FQDN Matching describes how the firewall matches domain names in an FQDN to a DNS proxy rule. If no match is found, default DNS servers resolve the query.
      4. Do one of the following, depending on what you set the Location to:
        • If you chose a virtual system, select a DNS Server profile.
        • If you chose Shared, enter a Primary and optionally a Secondary address.
      5. Click OK.
    3. (Optional) Supply the DNS Proxy with static FQDN-to-address entries. Static DNS entries allow the firewall to resolve the FQDN to an IP address without sending a query to the DNS server.
      1. On the Static Entries tab, Add a Name.
      2. Enter the Fully Qualified Domain Name (FQDN).
      3. For Address, Add the IP address to which the FQDN should be mapped.
        You can provide additional IP addresses for an entry. The firewall will provide all of the IP addresses in its DNS response and the client chooses which address to use.
      4. Click OK.
    4. (PAN-OS 11.2.1 and later releases) (Optional) Configure the DNS proxy to accept encrypted DNS queries from DNS clients and send encrypted DNS queries to DNS servers.
      1. On the Encrypted DNS tab, Enable Encrypted DNS.
        If Enable Encrypted DNS isn't selected, the DNS proxy sends cleartext DNS requests to DNS servers, whether the client DNS request is encrypted or not.
      2. For Server Settings, select one Connection Type that the firewall (DNS proxy) will use to communicate with DNS servers:
        • DoH—DNS over HTTPS (Hypertext Transfer Protocol Secure). DoH uses port 443. When encrypted DNS is enabled and DoH is the connection type:
          • A primary DNS address is required and the DNS proxy sends all DNS requests to the primary DNS server using DoH. If no response arrives from the primary DNS server, the DNS proxy sends DoH requests to the secondary DNS server.
          • No other HTTPS services are allowed on the interface that is acting as a DNS proxy.
          • An SSL decryption policy must be configured from the DNS client to DNS server so that the DNS proxy can decrypt DoH traffic.
        • DoT—DNS over TLS (Transport Layer Security). DoT uses port 853, which is dedicated to DoT traffic. When encrypted DNS is enabled and DoT is the connection type:
          • A primary DNS address is required and the DNS proxy sends all DNS requests to the primary DNS server using DoT. If no response arrives from the primary DNS server, the DNS proxy sends DoT requests to the secondary DNS server.
          • No other TLS services are allowed on the interface that is acting as a DNS proxy.
        • Origin—DNS proxy sends all DNS requests to the primary DNS server using the same DNS type as that received from the client. A primary DNS address is required. If the DNS proxy receives no DNS response from the primary DNS server within the TCP timeout period, the DNS proxy sends the DNS request to the secondary DNS server.
        • Cleartext—Plain, unencrypted DNS traffic.
      3. Select Fallback on Unencrypted DNS to have the DNS proxy fall back to traditional DNS (cleartext) if the DNS server rejects encrypted DNS or times out (the DNS proxy receives no response of the configured connection type [DoH or DoT] from the primary or secondary DNS server within the configured TCP timeout period).
      4. Enter the TCP Timeout (sec) in seconds, the length of time by which the primary DNS server must respond before the DNS query goes to the secondary DNS server, and the length of time by which the secondary DNS server must respond before the DNS query falls back to cleartext DNS communications; range is 1 to 10; default is 1 second.
      5. For Client Settings, select one or more Allowed DNS Types that the DNS proxy will accept from the client:
        • DoH—DNS proxy must decrypt DoH traffic and proxy DNS as specified for Server Settings:
          • If Origin is the Server Setting, the DNS proxy sends DNS requests as DoH.
          • If DoH is the Server Setting, the DNS proxy sends DNS requests as DoH.
          • If DoT is the Server Setting, the DNS proxy sends DNS requests as DoT.
        • DoT—DNS proxy must decrypt DoT traffic and proxy DNS as specified for Server Settings:
          • If Origin is the Server Setting, the DNS proxy sends DNS requests as DoT.
          • If DoH is the Server Setting, the DNS proxy sends DNS requests as DoH.
          • If DoT is the Server Setting, the DNS proxy sends DNS requests as DoT.
        • Cleartext—DNS proxy must proxy DNS requests as specified for Server Settings:
          • If Origin is the Server Setting, the DNS proxy sends DNS requests as cleartext.
          • If DoH is the Server Setting, the DNS proxy sends DNS requests as DoH.
          • If DoT is the Server Setting, the DNS proxy sends DNS requests as DoT.
          If cleartext is disabled for Client Settings, DNS proxy ignores or drops cleartext traffic.
      6. Select an SSL/TLS Service Profile or create a new SSL/TLS Service Profile to use for DNS encryption between the client and DNS proxy, or select None.
      7. Click OK.
    5. Enable caching and configure other advanced settings for the DNS Proxy.
      1. On the Advanced tab, select TCP Queries to enable DNS queries using TCP.
        • Max Pending Requests—Enter the maximum number of concurrent, pending TCP DNS requests that the firewall will support (range is 64 to 256; default is 64).
      2. For UDP Queries Retries, enter:
        • Interval (sec)—Length of time (in seconds) after which another request is sent if no response has been received (range is 1 to 30; default is 2).
        • Attempts—Maximum number of UDP query attempts (excluding the first attempt), after which the next DNS server is queried (range is 1 to 30; default is 5.)
      3. Select Cache to enable the firewall to cache FQDN-to-address mappings that it learns. You must enable Cache (enabled by default) if this DNS proxy object is used for queries that the firewall generates (that is, under DeviceSetupServicesDNS, or under DeviceVirtual Systems and you select a virtual system and GeneralDNS Proxy.
        • Select Enable TTL to limit the length of time the firewall caches DNS resolution entries for the proxy object. Disabled by default.
          • Enter Time to Live (sec), the number of seconds after which all cached entries for the proxy object are removed. After the entries are removed, new DNS requests must be resolved and cached again. Range is 60 to 86,400. There is no default TTL; entries remain until the firewall runs out of cache memory.
        • Cache EDNS Responses—You must enable this setting if this DNS proxy object is used for queries that the firewall generates (that is, under DeviceSetupServicesDNS, or under DeviceVirtual Systems and you select a virtual system and GeneralDNS Proxy.
    6. Commit your changes.
      Click OK and Commit.

    Configure DNS Proxy with IPv6

    You can configure DNS Proxy with complete dual-stack IPv6 support, enabling firewalls to forward DNS requests between clients and servers regardless of whether each side uses IPv4 or IPv6.
    Interfaces assigned to a DNS Proxy object must have both an IPv4 and an IPv6 address configured if both IPv4 and IPv6 upstream DNS servers are in use.
    Prerequisites
    Before configuring DNS Proxy with IPv6, confirm the following:
    • Your firewall is running PAN-OS 12.2.0 or later.
    • The interfaces you plan to assign to the DNS Proxy object have both an IPv4 and an IPv6 address configured — this is required if you intend to use both IPv4 and IPv6 upstream DNS servers.
    • You have an IPv6-capable routing path from the firewall to your upstream DNS servers.
    1. Configure the Interface IP Addresses.
      1. Navigate to Network > Interfaces.
      2. Select the interface that will receive client DNS traffic.
      3. On the IPv4 tab, confirm an IPv4 address is assigned.
      4. On the IPv6 tab, enable IPv6 and assign an IPv6 address.
      5. Click OK and repeat for any additional interfaces that will be part of the DNS Proxy.
        This dual-address requirement is critical. The DNS Proxy daemon uses the incoming client-side interface IP address as the source IP when forwarding to upstream servers. If only one IP version is configured on the interface, forwarding to a server of the other IP version will fail.
    2. Configure the DNS Proxy Object.
      1. Navigate to Network > DNS Proxy.
      2. Set a descriptive Name.
      3. Choose the scope:
        • Shared — applies to all virtual systems. Enter Primary and (optionally) Secondary DNS server IP addresses directly. These can be IPv4, IPv6, or one of each.
        • Virtual System — select a specific vsys, then select or create a DNS Server Profile (see Step 3).
      4. Under Interfaces, click Add and select all interfaces that should accept DNS queries via this proxy. Ensure each interface has both IPv4 and IPv6 addresses (see Step 1).
      5. Optionally configure DNS Proxy Rules to direct specific domain queries to specific upstream servers.
      6. On the Advanced tab:
        • Enable Cache (required if the DNS Proxy is used for firewall-generated queries).
        • Enable Cache EDNS Responses if applicable.
        • Enable TCP Queries if you need DNS-over-TCP support.
      7. Click OK.
    3. Configure a DNS Server Profile (Virtual System only).
      If you are using a virtual system DNS Proxy, a DNS Server Profile gives you control over which IP address the firewall uses as the source when reaching IPv4 vs. IPv6 DNS servers.
      1. Navigate to Device > Setup > Services (or Device > DNS Server Profile).
      2. Click Add and give the profile a name.
      3. Under Primary DNS Server, enter an IPv4 or IPv6 address.
      4. Under Secondary DNS Server, enter an address (can be a different IP version from Primary — failover across IP versions is supported in 12.2.0).
      5. Configure the Service Route IPv4 section: select the source interface and IPv4 source address to use when the target DNS server is IPv4.
      6. Click Service Route IPv6 and configure the source interface and IPv6 Source Address to use when the target DNS server is IPv6.
      7. Click OK.
    4. Assign the DNS Proxy to the Interface/Virtual System:
      • For a shared DNS Proxy, assignment happens automatically based on the interfaces you added in Step 2.
      • For a virtual system DNS Proxy, navigate to Device > Virtual Systems, select the vsys, and under the General tab set the DNS Proxy field to the object you created.
    5. Commit your changes.
      Verification
      After committing, verify DNS Proxy behavior using the CLI:
      # Show DNS Proxy status and configured servers
show dns-proxy all
# Monitor live DNS Proxy activity
debug dnsproxyd statistics
# Tune TCP failover timers if needed (optional)
debug dnsproxyd tcp-timers conn-timeout 4
debug dnsproxyd tcp-timers data-timeout 30
      To confirm IPv6 forwarding is working, check the logs:
      # Should show matching IP versions for Server and Source IP
tail /var/log/dnsproxyd.log
      If you see a mismatch — e.g., an IPv6 server address paired with an IPv4 source IP — double-check that the assigned interface has an IPv6 address configured.
      To show the DNS Proxy configuration:
      show dns-proxy settings all
      For the activity (general statistics):
      show dns-proxy statistics all
debug dnsproxyd show sys-statistics
      For the TCP timers, it is better to show the range:
      debug dnsproxyd tcp-timers conn-timeout <1-120>
debug dnsproxyd tcp-timers data-timeout <1-300>
      To display the dnsproxyd log from admin command:
      tail follow yes mp-log dnsproxyd.log

    © 2026 Palo Alto Networks, Inc. All rights reserved.