Thread Info
  • State Suggested Answer
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 1278 views
  • Users 0 members are here
Options
Suggested

uncategorized blocking well known domains, including sophos

JamesGolden

I had uncategorized sites blocked in dns protection. But along with blocking OneDrive sync, it was also blocking Sophos community.  

Even after allowing uncategorized, I still had to add a domain exception for sophos.com.  

I also had to add exceptions for my domain and some of my client's domains, even though in sophos firewall and intercept-x I don't have a problem blocking uncategorized sites. 

  • 0

    Hi James,

    Thanks for reporting this issue. I can reproduce it here so we will investigate. It seems to happen when the domain requested initially resolves to a CNAME alias which is in a domain that is itself not categorized. This shouldn't be the case.

    Can you confirm that you are still able to get to www.sophos.com, and central.sophos.com. These do not use the same CNAMEs as the community site.

    If you can provide any other specific domain/hostnames for other sites that are experiencing this issue, I'd be grateful. Feel free to contact me via DM if you'd prefer.

    Regards

    Rich

  • 0 in reply to RichBaldry

    The domain used as a CNAME alias for community.sophos.com has now been recategorized. It should now be fine with your policy.

    Were you using a local resolver for your network? We have seen this kind of issue in the past where a domain uses a CNAME and the CNAME alias has a different categorization to the principal domain. Sometimes a local DNS server will cache the CNAME response to the primary domain and only lookup the CNAME alias. If the primary domain is 'Allowed' but the CNAME alias is blocked, this can result in the local DNS server returning a blockpage IP address for the primary domain.

    Please let us know any specific other domains that are being blocked.

  • 0 in reply to RichBaldry

    I'm pointing my clients to my sophos firewall which is using the dns protection resolvers. 

    fyi...after turning uncategorized back to block, I'm seeing darkcubed.net (for celerium's network defender WAN protection), SharePoint (sharepoint.com.dual-spo-0005.spo-msedge.net), and some of my own domains still (one of which I listed in my private message).

Unfiltered HTML