top of page
Search

ZPA DNS Suffix Missing: App Opens by IP, Fails by Name

  • 3 days ago
  • 2 min read
Zscaler network security troubleshooting lab
Zscaler · Techclick CLI troubleshooting lab
Remote user can RDP by IP through ZPA. The same host name does not resolve. On-LAN works.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Zscaler for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

ZPA only intercepts names you publish. Add the FQDN or the DNS search suffix to the application segment and the client forwarding profile.

Why this ticket shows up

ZCC is not a full corporate DNS server. If the segment is IP-only, name resolution never goes to ZPA.

Symptoms operators actually see

  • IP works, FQDN NXDOMAIN

  • nslookup of the short name fails

  • Works after the user types the FQDN sometimes

  • New domain was added in AD last week

CLI first — copy this block

Run these on the Zscaler device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

nslookup app01
nslookup app01.corp.local
ipconfig /all | findstr /i "suffix"
powershell -c "Get-DnsClientNrptPolicy"

How to read that output

If the short name has no suffix and NRPT does not send corp.local to ZPA, the query never hits the connector. IP success only proves the application port is published.

Triage order

  1. Resolve short name and FQDN on the failing laptop.

  2. Add the FQDN and the DNS suffix to the application segment.

  3. Confirm the forwarding profile includes that domain.

  4. Flush DNS and retry.

  5. Do not publish the entire AD DNS as a shortcut without review.

Classic traps

What you see

Real cause

Fix

Publish 10.0.0.0/8

User typed a short name

Fix suffix

Reinstall ZCC

NRPT missing the domain

Update the profile

It is an RDP bug

IP already works

It is DNS

Proof the ticket is closed

  • nslookup app01.corp.local returns the internal IP via ZPA

  • RDP by name works

  • Segment lists the FQDN

Say this in an interview

ZPA IP success plus name failure is a published-domain problem, not an RDP problem.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page