One of our customers recently ran into a puzzling issue that we thought would be useful to share here—especially to help others avoid a wild goose chase.

The scenario:
They noticed a domain was being blocked, but:

• No filtering categories were enabled that should block it
• The domain didn’t appear suspicious
• The Query Log showed the domain as blocked, but didn’t offer a clear reason for the block

After some digging, we found the cause: the domain was on the Universal Block List.

Here’s the catch:
Domains blocked via Universal Lists won’t appear in the Policies column in the Query Log. These lists apply globally across all policies, so they’re a common “gotcha” when something seems to be blocked “without reason.”

Here’s 3 different methods that can confirm this is happening to you:

1. Check the domain in Domain Report:*
   • Search the domain in Domain Report—any Universal List entry will show under Policy Summary
2. Enable the Method column in your Query Log:
   • In the Query Log, click the Preferences gear icon
   • Toggle on the Method column to see how each domain was classified and filtered
   • If the Policy column is blank and the Method column shows Blocked Blacklist that's a good indication a Universal list is at play
3. Try to modify the domain’s status:*
   • Click the domain in the Query Log and go to the Actions menu
   • Attempt to add it to your allow/block list
   • If it’s on a Universal List, you’ll see a message like:
     "REMOVE FROM UNIVERSAL BLOCK LIST"

We hope this tip saves you time if you ever run into a similar situation. If you have questions about Universal Lists or want to discuss other edge cases, feel free to drop a comment below!

*MSP clients won't see this in their Query Logs or Domain Report tool. Stick to method #2 to discover Universal List blocks.