You can manually specify the server used to facilitate Advanced DNS Security queries. While Palo Alto Networks recommends using the default global service domain, you can override the selected server if you encounter higher than expected latency or other service-related issues. By default, in PAN-OS 11.2 - 11.2.8, DNS Security and Advanced DNS Security connects to the global service domains (dns.service.paloaltonetworks.com and adv-dns.service.paloaltonetworks.com,respectively), which then automatically redirect to the regional domain that is closest to the network security platform location. The regional FQDN settings only impact Advanced DNS Security response traffic, while request traffic (DNS Security) continues through the global service domain for inspection.

The following table lists the service domains used by Advanced DNS Security:

PAN-OS 11.2.9 and later provides consolidated service domains for Advanced DNS Security and DNS Security subscription services and the ability to allow users to manually select their preferred regional FQDN settings. Both DNS Security and Advanced DNS Security traffic (requests and responses) are routed to the default (or user-defined) regional service domain. This creates a more unified and predictable experience for your DNS security services as it establishes a consistent DNS security inspection process by ensuring both request and response traffic follow the same regional routing path. The provides better alignment with chosen regional points of presence and gives customers greater control when using regional service domains for their security infrastructure.

The following table lists the service domains used by both Advanced DNS Security and DNS Security: