To maintain full visibility and control over modern encrypted traffic, the firewall can inspect DNS over TLS (DoT) requests. While encryption normally prevents the NGFW from seeing the destination of a DNS query, enabling SSL Decryption allows the firewall to intercept and decrypt the packet payload. Once decrypted, the DNS request is handed off to DNS Security, where it is evaluated against your Anti-Spyware profile and DNS policy settings just like standard plaintext DNS traffic.

When a DNS request is identified as originating from a TLS source (typically using TCP port 853), the firewall processes it according to your configured security rules. If a threat is detected or a domain is blocked, the event is recorded in the Threat Logs. To specifically isolate and monitor these encrypted queries, you can filter your logs for traffic where the Destination Port is 853. This visibility is essential for identifying sophisticated malware techniques that attempt to bypass traditional security controls by hiding malicious lookups within encrypted tunnels.

To ensure this inspection occurs, you must configure a Decryption Policy rule that targets the dns-over-tls application. Without a valid decryption rule, DoT traffic will bypass DNS Security inspection and appear in the traffic logs as generic encrypted data. By successfully decrypting this traffic, you ensure that your DNS-layer protections, including sinkholing and domain categorization.