Which issue triggers the Cisco Umbrella resolver to toward DNS requests to the intelligent proxy?

If a domain is nonexistent, the DNS resolver will return an NXDOMAIN response, not forward the request to an intelligent proxy.

If a domain is block-listed, Umbrella will block the DNS resolution or redirect the user to a block page, not forward the request to an intelligent proxy for further inspection.

If a domain is locally reachable and not considered suspicious by Umbrella, the DNS request will be resolved directly without involving the intelligent proxy.

Cisco Umbrella uses an intelligent proxy to provide deeper inspection of traffic for domains that are "grey-listed." Grey-listed domains are those that are not explicitly known to be malicious or safe, often indicating new or suspicious sites that warrant further analysis for potential threats. When a DNS request for a grey-listed domain is made, Umbrella's DNS resolver directs the web request to the intelligent proxy for HTTP/HTTPS inspection.