This article applies to:

• SWG 9.x
• SWG 10.x

Question:

• Does SWG perform DNS lookups for blocked transactions?

Answer:

The Trustwave Secure Web Gateway may perform name resolution for the destination host involved in a blocked transaction, especially when the transaction is blocked during the response phase.  In order to block a transaction based content from the target site, SWG must first retrieve the content for scanning purposes.  It is normal for SWG to perform a DNS lookup during the course of connecting to a destination site.  If a network monitoring tool reports that SWG is performing DNS lookups in relation to transactions that should be blocked, this does not indicate that SWG is allowing malicious content to reach client systems.