{"id":4142,"date":"2026-06-08T18:00:55","date_gmt":"2026-06-08T15:00:55","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4142"},"modified":"2026-06-08T18:00:55","modified_gmt":"2026-06-08T15:00:55","slug":"policy-manager-shows-alert-a-dns-query-was-blocked-for-a-domain","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fr\/support-articles\/policy-manager-shows-alert-a-dns-query-was-blocked-for-a-domain\/","title":{"rendered":"Policy Manager shows alert: \u00ab\u00a0A DNS query was blocked for a domain\u00a0\u00bb"},"content":{"rendered":"<h3>Issue:<\/h3>\n<ul>\n<li>\n<p><span style=\"font-size: 12px;\">When user tries to access some specific web Sites, admin gets alerts in Policy Manager Console that a DNS query was blocked for a domain<\/span><\/p>\n<\/li>\n<li>\n<p><span style=\"font-size: 12px;\">We get error from Policy Manager containing &quot;<span style=\"color: black;\">309\u00a0\u00a0\u00a0 2020-03-22\u00a0 21:57:47+01:00\u00a0 SERVER0X SYSTEM\u00a0 F-Secure Network Filter\u00a0 1.3.6.1.4.1.2213.11.1.12\u00a0Blocked a DNS query for the following unsafe domain:\u00a0 www.<a href=\"http:\/\/www.dracoon.team\" style=\"color: blue;text-decoration: underline;\" target=\"_blank\" rel=\"noopener\">t<\/a>est.com<\/span><\/span><\/p>\n<\/li>\n<\/ul>\n<h3>Resolution:<\/h3>\n<p><span style=\"font-size: 12px;\"><b>Note: <\/b>The notifications you get from F-Secure Policy Manager Server regarding the DNS Filter, are not errors. These are alerts\/notifications send from Clients.F-Secure Policy Manager does not generate errors on behalf of clients. Clients generate errors locally, and they only send alerts to Policy Manager.<br \/>If the alert forwarding is enabled via Policy Manager, each time a query is blocked, admin will be notified according to that.<\/p>\n<p>This is an expected behavior, and to understand it better, please read the explanation bellow:<br \/>DNS queries are based on ORSP rating, so ORSP needs to be activated from Policy Manager Console for all Clients.<br \/>How to enable Security Cloud using F-Secure Policy Manager Console:<\/span><\/p>\n<ol>\n<li>\n<p><span style=\"font-size: 12px;\">Log in to WithSecure Policy Manager Console and navigate to Advanced view<\/span><\/p>\n<\/li>\n<li>\n<p><span style=\"font-size: 12px;\"><span style=\"color: #0d0d0d;\">Expand the F-Secure Security Cloud Client Settings and make sure the &quot;allow deeper analyses&quot; and &quot;Client is enabled&quot; is set to &quot;yes&quot; and distribute the policy.<\/span><\/span><\/p>\n<\/li>\n<\/ol>\n<p><span style=\"font-size: 12px;\"><span style=\"color: #0d0d0d;\">ORSP stands for Object Reputation Service Protocol.<\/span>\u00a0When a new object, such as a file or URL, is encountered on one client, the product communicates with the Security Cloud using the strongly encrypted Object Reputation Service Protocol (ORSP) to query for the object&#39;s reputation details. Anonymous metadata about the object, such as file size and anonymized path, are sent to the Security Cloud.\u00a0<span style=\"color: #0d0d0d;\">You may find more information about the Security Cloud here:\u00a0<\/span><a href=\"https:\/\/www.f-secure.com\/en\/web\/legal_global\/privacy\/security-cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/www.f-secure.com\/en\/web\/legal_global\/privacy\/security-cloud<\/a><\/p>\n<p><b><span style=\"color: #212121;\">Botnet blocker works on the level of DNS resolution and IP address filtering.<\/span><\/b><br \/><span style=\"color: #212121;\">When DNS filtering is enabled, we don&#39;t allow to resolve DNS addresses if we know these DNS addresses are not safe.<\/span><br \/><span style=\"color: #212121;\">When IP reputation filtering is enabled, we block connections to IP addresses for which we have reputation in ORSP.<\/span><br \/><b><span style=\"font-weight: bold;\">When you allow all queries, it means you have disabled DNS filter, by doing this you are disabling DNS scanning on NIF (Network interception Framework) level.<\/span><\/b><br \/>If you set to example \u201eAllow safe queries only \u201eit might still block local DNS.<br \/>DNS record information is usually cached (stored on your local browser, computer or network forwarder) for a specific amount of time; anywhere from 5 minutes to 8 hours is normal.<\/span><\/p>\n<ul style=\"margin-left: 36px;\">\n<li style=\"\">\n<p><span style=\"font-size: 12px;\">block unsafe =&gt; unknown, susp, safe will go thru. <\/span><\/p>\n<\/li>\n<li style=\"\">\n<p><span style=\"font-size: 12px;\">unsafe (malicious) are blocked Block unsafe, susp =&gt; unknown and safe go thru. <\/span><\/p>\n<\/li>\n<li style=\"\">\n<p><span style=\"font-size: 12px;\">unsafe (malicious) and suspicious are blocked allow safe only =&gt; only safe rated go thru. unknown, suspicious, unsafe (malicious) are blocked<\/span><\/p>\n<\/li>\n<\/ul>\n<p style=\"\"><span style=\"font-size: 12px;\"><span style=\"color: #0d0d0d;\"><span style=\"font-weight: bold;\">Blocking botnet communication<\/span><\/span><\/span><\/p>\n<p><span style=\"font-size: 12px;\"><span style=\"color: #0d0d0d;\">Botnet Blocker is a security feature that aims to prevent botnet agents from communicating with their command and control servers.<\/span><br \/><span style=\"color: #0d0d0d;\">The feature uses DNS reputation data to verify the security of queries when translating DNS requests to IP addresses.<\/span><br \/><span style=\"color: #0d0d0d;\">To configure Botnet Blocker in\u00a0<\/span><span style=\"font-weight: bold;\"><span style=\"color: #2e0f5b;\">Standard view<\/span><\/span><span style=\"color: #0d0d0d;\">:<\/span><\/span><\/p>\n<ol style=\"margin-left: 36px;font-family: Calibri;font-size: 11.0pt;font-weight: normal;font-style: normal;\">\n<li style=\"\">\n<p><span style=\"font-size: 12px;\"><span style=\"font-weight: normal;\"><span style=\"font-style: normal;\"><span style=\"color: #0d0d0d;\">On the\u00a0<\/span><\/span><\/span><span style=\"font-weight: bold;\"><span style=\"font-style: normal;\"><span style=\"color: #222222;\">Settings<\/span><\/span><\/span><span style=\"font-weight: normal;\"><span style=\"font-style: normal;\"><span style=\"color: #0d0d0d;\">\u00a0&gt;\u00a0<\/span><\/span><\/span><span style=\"font-weight: bold;\"><span style=\"font-style: normal;\"><span style=\"color: #222222;\">Web traffic scanning<\/span><\/span><\/span><span style=\"font-weight: normal;\"><span style=\"font-style: normal;\"><span style=\"color: #0d0d0d;\">\u00a0page, go to\u00a0<\/span><\/span><\/span><span style=\"font-weight: bold;\"><span style=\"font-style: normal;\"><span style=\"color: #222222;\">Botnet blocker<\/span><\/span><\/span><\/span><\/p>\n<\/li>\n<li style=\"\">\n<p><span style=\"font-size: 12px;\"><span style=\"color: #0d0d0d;\">Set the filtering to use for DNS queries.<\/span><\/span><\/p>\n<\/li>\n<\/ol>\n<p><span style=\"font-size: 12px;\"><span style=\"color: #0d0d0d;\">By default, this set to\u00a0<\/span><span style=\"font-weight: bold;\"><span style=\"color: #222222;\">Block unsafe queries<\/span><\/span><span style=\"color: #0d0d0d;\">.<\/span><\/span><\/p>\n<ol style=\"margin-left: 36px;font-family: Calibri;font-size: 11.0pt;font-weight: normal;font-style: normal;\">\n<li style=\"\">\n<p><span style=\"font-size: 12px;\"><span style=\"font-weight: normal;\"><span style=\"font-style: normal;\"><span style=\"color: #0d0d0d;\">Set the alert level to use for notifications of blocked DNS queries.<\/span><\/span><\/span><\/span><\/p>\n<\/li>\n<li style=\"\">\n<p><span style=\"font-size: 12px;\"><span style=\"color: #0d0d0d;\">Distribute the policy:<\/span><\/span><\/p>\n<\/li>\n<\/ol>\n<p><span style=\"font-size: 12px;\">You can choose what works for you best, you have different option in Policy Manager Console:<br \/><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>When ever user tries to access specific web Sites, admin gets alerts that a DNS query was blocked for a domain<\/p>\n","protected":false},"template":"","support_article_product":[106],"class_list":["post-4142","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000014149","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 15:00:55","import_hash":"7b62e224427ca4b121cc8526eaea74a9028ba461","vanilla_article_id":29397,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/29397-policy-manager-shows-alert-a-dns-query-was-blocked-for-a-domain","vanilla_kb_id":30,"vanilla_category_id":103,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article\/4142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/media?parent=4142"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article_product?post=4142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}