One of our customers recently ran into a puzzling issue that we thought would be useful to share here—especially to help others avoid a wild goose chase.

The scenario:
They noticed a domain was being blocked, but:

• No filtering categories were enabled that should block it
• Nothing showed in the Domain Report Tool under AppAware or Threats
• The domain didn’t appear suspicious
• The Query Log showed the domain as blocked, but didn’t offer a clear reason for the block

After some digging, we found the cause: the domain was on the Universal Block List.

Here’s the catch:
Domains blocked via Universal Lists won’t appear in the Domain Report Tool or show as part of the Policies column in the Query Log. These lists apply globally across all policies, so they’re a common “gotcha” when something seems to be blocked “without reason.”

Here’s how you can confirm if this is happening to you:

1. Enable the Method column in your Query Log:
   • In the Query Log, click the Preferences gear icon
   • Toggle on the Method column to see how each domain was classified and filtered
   • This will indicate if a Universal List was involved
2. Try to modify the domain’s status:
   • Click the domain in the Query Log and go to the Actions menu
   • Attempt to add it to your allow/block list
   • If it’s on a Universal List, you’ll see a message like:
     "REMOVE FROM UNIVERSAL BLOCK LIST"

We hope this tip saves you time if you ever run into a similar situation. If you have questions about Universal Lists or want to discuss other edge cases, feel free to drop a comment below!