Had to disable ultrasurf to get access to cloudfront url' s??

[Daneels]

Hi all, recently I got a call from an employee that he could not get on some part of the mailchimp website. Some images were not loading either. Further examination showed me that it was static.mailchimp.com giving me problem. (nslookup for example failed) This in turn pointed into the direction of urls in the .cloudfront.net domain. When looking into dns (and the firewall) I noticed that on a number of occasions our internal DNS servers tried to contact a number of destinations from the .gtld-servers.net but were blocked (giving Ultrasurf_9.6+ as the reason). I have (as a test) disabled the blocking of ultrasurf_9.6+ and yes... mailchimp works, and I notice also a faster loading of numerous websites because the also tend to access .cloudfront.net servers. So my question... why would my internal DNS server send out stuf to gtld-servers and get Ultrasurf blocks? I fail to understand (my knowledge of DNS is not deep enough to get to the bottom of this. Regards Peter