DNS problems

A domain is blocked

Review the history event: domain name, decision, rule source and app policy. A parent rule can cover subdomains; an exception is added for a specific name. Under a block-all-DNS policy, an exception alone is not enough.

A query is allowed but no response arrives

Allowed queries are sent to Cloudflare over HTTPS. A network failure, upstream availability issue or timeout can leave an app without a response. Local queue overflow produces SERVFAIL. Automatic switching to an arbitrary backup resolver is not claimed.

Compare behaviour with protection stopped and retain the error time, network type and diagnostic file if available. Avoid changing several network settings at once, which makes attribution harder.

There are no events although the app works

An app may use its own encrypted DNS, direct IP addresses or a cache. A missing event proves neither blocking nor complete protection. Normal-mode app attribution can also be incomplete.

A rules update failed

The current rules should remain active. The bundled list is a rules fallback, not a different resolver. Keep the error message and check the network. Read how filtering works.