DNS snooping for FQDN-based firewall rules

[SimonT]

Could anyone explain the correct setup so that Meraki can do DNS snooping for FQDN-based firewall rules with the following environment?

Windows network with Windows DHCP and DNS Servers.
Windows endpoints with Secure Client and Umbrella

Endpoints DNS points to Umbrella virtual appliances with local DNS pointing back to Windows DNS servers.
Active directory integrated with Umbrella.
MX84 Firewall

MX84 does not see DNS requests from endpoints so FQDN-based firewall rules fail. How should this be setup  ? must keep Windows DHCP servers and local DNS going for Active Directory.

[RaphaelL]

Hi ,

DNS requests must be seen by the MX. So they can't be encrypted and can't be intra-vlan DNS requests. 

DNS requests over Auto-VPN/NMVPN is fine.

DNS requests over Internet is fine.

DNS requests inter-vlan is fine.