Troubleshoot Common DNS Request Types Available in the Umbrella Reports

Introduction 

This document describes the DNS Request Types that can be collected and listed in a report. Each record type has its own purpose in the DNS infrastructure. When thinking DNS, the first record type that comes to mind is the A Record which is the IPv4 IP address belonging to the hostname of the domain. 

Note: This list is by no means exhaustive.  A more complete list, including the relevant RFC for each record type can be found here: https://en.wikipedia.org/wiki/List_of_DNS_record_types

With regards to blocked security domains , please note that Cisco Umbrella blocks A, AAAA, ANY, CNAME, PTR, SRV, PRIVATE, SPF/DNS, NULL, SIG, HTTPS (Type65), and TXT records, so queries for other record types (MX, SOA, and NS) are allowed, even though the category is blocked.  However, requests for MX records of domains that have been categorized as "DNS Tunneling VPN" are refused.

"Allowed" Security Categories in Umbrella Reports

Cisco Umbrella is committed to DNS security. DNS record types observed to be capable of facilitating malicious connections (for example, A/AAAA) or tunneling traffic (TXT, SRF, etc) or allowing bypass of standard DNS (Type65, etc) are enforced. Some record types that are reference records like MX, SOA, NS are permitted even if tagged in a security category. If you believe a record type that is not blocked should be blocked, contact us at umbrella-support@cisco.com to request. We monitor for new threat types to ensure that all records capable of delivering a malicious connection are enforced - without blocking request types that hinder informational requests on the domain's ownership or mail servers. 

To validate if an "Allowed" Malware request is due to an alternate record type request, open your Activity search and add the DNS record type column. This is surfaced transparently to reporting - and does not indicate a failure to protect or a coverage gap.

For content filtering categories, types other than AAAA, A records are not blocked. Destination lists also do not block all record types, NS for example is not blocked. 

To view the record type of a request in the Activity Search, toggle the "DNS Types" column.

If a domain is "blocked", queries for address record types A and AAAA return IP addresses that belong to Umbrella block pages.  Queries for DNS record types ANY, CNAME, PTR, SRV, SIG, or TXT return "REFUSED".  (Note:  when querying for domains classified as Dynamic DNS, address record types A and AAAA are blocked, but queries for other DNS record types do not return "REFUSED".) The full list of types we return "REFUSED" on are: 3-5,7-10, 12, 16, 30, 33, 38, 64, 65, 99, 245, 253, 255, 65280-65534.

Exceptions:

• DNS Tunneling domains "block" all record types.
• Dynamic DNS category we only block A/AAAA records

DNS Lookup Types & Functions