Palo Alto Networks incident
ADNS/ADNSR - False Positive Detection Incident
Resolved after 1 minute, affecting ADNS Resolver 96.9.97.9 and ADNS Resolver 96.9.96.9, on March 6, 2026.
This incident has been resolved. We have identified the root cause. The incorrect verdict was due to multiple 3rd party intelligence feeds providing malicious verdicts. Enhancement measure will be added to reduce false positives caused by CNAME domains from 3rd party intelligence ingestions.
Affected components
Update timeline
- investigating Mar 06, 2026, 08:22 PM UTC
One of our detectors is experiencing an issue that caused false positive blocking. Specifically, res-stls-prod[.]edgesuite[.]net.globalredir[.]akadns88[.]net was misclassified as phishing from 3/6/2026 13:08 UTC to 3/6/2026 16:50 UTC. This domain is a CNAME of res.cdn.office[.]net and res-stls-prod.edgesuite[.]net. So, the DNS resolution of res.cdn.office[.]net or res-stls-prod.edgesuite[.]net might experience blockage during the period of time mentioned above.
- investigating Mar 06, 2026, 08:23 PM UTC
We have disabled the false positive signature to resume customer utility. We are continuing to investigate the root cause.
- resolved Mar 06, 2026, 08:24 PM UTC
This incident has been resolved. We have identified the root cause. The incorrect verdict was due to multiple 3rd party intelligence feeds providing malicious verdicts. Enhancement measure will be added to reduce false positives caused by CNAME domains from 3rd party intelligence ingestions.
Your product runs on more than Palo Alto Networks
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services