In this article

When DNSFilter forwarders are configured on a Windows AD/DNS server, Event ID 5504 may be generated. This event is expected behavior and does not indicate a problem.

Event ID 5504 occurs when a DNS request is blocked by DNSFilter, typically because the domain or its associated category is restricted by the active filtering policy.

To identify the specific domain involved, open the event entry and select the Details tab in Friendly View. The Binary Data section will display information about the blocked domain.