Sorry to reopen this thread, but am I the only person that thinks "DNS snooping" is the most nonsensical way to resolve hostnames to IP Addresses? The resolver libraries and related functions have been part of UNIX systems for like 40 years, which provide a reliable way to resolve hostnames, that don't require snooping traffic. It is very common in large networks that the DNS traffic between the client and DNS server is intra-VLAN and would never been snoopable by the MX.   I would strongly encourage everyone affected by this unreliable FQDN resolution implementation to... Open a support case regarding this issue Use the "Give your feedback" asking for a reliable FQDN implementation Contact and speak to your Cisco Account Manager regarding this unreliable FQDN resolution implementation. ... View more