The issue occurs because the IPS engine does not recognize port 853 for decoding, causing it to skip the DNS dissector.
Workaround:
Run the following commands to add port 853 to the IPS decoder port list:
config ips decoder "dns_decoder"
config parameter "port_list"
set value "53,853"
end
end
Restart the IPS engine to apply the changes:
diagnose test application ipsmonitor 99
Sample result that shows it working, as the default block IP address of 208.91.112.55 is returned over TLS:
dig @p2.freedns.controld.com +tls +all http://www.nab.com.au
; <<>> DiG 9.17.12 <<>> @p2.freedns.controld.com +tls +all http://www.nab.com.au
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41119
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;http://www.nab.com.au. IN A
;; ANSWER SECTION:
http://www.nab.com.au. 60 IN A 208.91.112.55
;; Query time: 46 msec
;; SERVER: 76.76.2.11#853(p2.freedns.controld.com) (TLS)
;; WHEN: Mon Jun 29 09:57:39 Romance Daylight Time 2026
;; MSG SIZE rcvd: 48
Sample result that shows it working as the default block IP address of 208.91.112.55 or 2620:101:9000:53 is returned over TLS:
q www.nab.com.au @https://p2.freedns.controld.com
www.nab.com.au.edgekey.net. 5m CNAME e361861.a.akamaiedge.net.
www.nab.com.au. 1h36m41s CNAME www.nab.com.au.edgekey.net.
www.nab.com.au. 1m HTTPS 1 . ipv4hint="208.91.112.55" ipv6hint="2620:101:9000:53::55"
www.nab.com.au. 1h36m40s CNAME www.nab.com.au.edgekey.net.
www.nab.com.au. 1m A 208.91.112.55
www.nab.com.au. 1m AAAA 2620:101:9000:53::55
Related documents:
DNS over QUIC and DNS over HTTP3 for transparent and local-in DNS modes | 
