Create DNS Firewall Rules

1. Open the Amazon VPC console.

   For general guidance on navigating the Amazon VPC console and managing DNS Firewall resources, refer to the Amazon Route 53 documentation.
2. Select DNS firewallRule groups and select the rule group where you want to add a Palo Alto Networks rule.

   The following steps assume you have already subscribed.
3. Choose Add rule.
4. Enter a Name for the rule and select the Advanced plan pricing option.

   Valid characters for rule names: A-Z, a-z, 0-9, hyphen (-), and underscore (_). Maximum 64 characters.
5. Under Rule configurations, select Partner managed DNS threat protection as the rule type and confirm Palo Alto Networks is selected as the vendor.
6. Select one or more Palo Alto Networks DNS security categories from the dropdown.

   The following DNS security categories are available:

   Category	Description
   Command and Control Domains	Domains used by malware to communicate with attacker-controlled infrastructure for instructions, data exfiltration, or payload delivery.
   Malware Domains	Domains that host or distribute malicious software, including exploit kits, ransomware droppers, and trojan delivery networks.
   Phishing Domains	Domains impersonating legitimate organizations to steal credentials or personal information through typosquatting, homograph attacks, or domain shadowing.
   Dynamic DNS Hosted Domains	Domains using dynamic DNS providers that allow rapid IP address changes, frequently abused by threat actors to evade IP-based blocking.
   Newly Registered Domains	Domains registered within the past 32 days. Attackers use fresh domains because they lack reputation history, making them harder to detect.
   Grayware Domains	Domains associated with applications that exhibit unwanted behavior such as excessive tracking, unsolicited advertising, or browser hijacking.
   Parked Domains	Domains displaying placeholder or "for sale" content. Attackers may acquire these to leverage residual reputation and redirect visitors to malicious content.
   Proxy Avoidance and Anonymizers	Domains providing services to bypass network security controls, including web proxies, VPN services, and anonymizing networks.
   Ad Tracking Domains	Domains used by advertising networks and third-party trackers to monitor user activity. These can serve as vectors for malvertising campaigns.

   You can select multiple categories in a single rule. For example, you might combine Command and Control Domains and Malware Domains in one high-priority blocking rule, and create a separate lower-priority alerting rule for Newly Registered Domains.

   Each selected security category creates a separate rule entry within the rule group. If you select 4 categories, 4 rules are created with sequential priorities.
7. (Optional) Select the Query type that you want to filter from the dropdown.

   The following query types are available:

   • A—Returns an IPv4 address.
   • AAAA—Returns an IPv6 address.
   • CAA—Restricts CAs that can create SSL/TLS certification for the domain.
   • CNAME—Returns another domain name.
   • DS—Record that identifies the DNSSEC signing key of a delegated zone.
   • MX—Specifies mail servers.
   • NAPTR—Regular expression based rewriting of domain names.
   • NS—Authoritative name servers.
   • PTR—Maps an IP address to a domain name.
   • SOA—Start of authority record for the zone.
   • SPF—Lists the servers authorized to send emails from a domain.
8. Choose the action for the rule.

   Available actions:

   • Block—Block the DNS query and prevent resolution.
   • Alert—Allow the DNS query to resolve but log the match for monitoring and investigation.

   See best practices for guidance on when to use each action.
9. Select Add rule when you have finished specifying your rule details.
10. From the Rules tab in the Rule groups page, new rule entries are displayed for each DNS Security category that you specified.
11. Assign a priority to the rule entries that have been created.

    DNS firewall evaluates rules in priority order (lowest number evaluated first). Assign lower priority numbers to rules that should take precedence. For example, assign priority 1 to a rule blocking Command and Control Domains and priority 100 to a rule alerting on Newly Registered Domains.