In this article
When DNSFilter forwarders are configured on a Windows AD/DNS server, Event ID 5504 may be generated. This event is expected behavior and does not indicate a problem.
Event ID 5504 occurs when a DNS request is blocked by DNSFilter, typically because the domain or its associated category is restricted by the active filtering policy.
To identify the specific domain involved, open the event entry and select the Details tab in Friendly View. The Binary Data section will display information about the blocked domain.
In the example pictured, www.deepseek.org is blocked, causing the 5504 message.
Comments
2 comments
OK, the conclusion is that it is blocked….
Who/what blocked it?
How do I change it so it doesn't get blocked?
Best regards,
Hey Igor ! 👋 The block is coming from your active DNSFilter filtering policy—that's what determines which domains and categories are allowed or restricted for your network.
Here are a few ways to dig in and adjust things:
For a deeper dive, the DNSFilter Help Center has resources on filtering policies, the Query Log, and Allow and Block Lists to help you get things sorted.
Please sign in to leave a comment.