Encrypting Traffic with DNSCrypt
Virtual Appliances support DNSCrypt between the virtual machine and the Secure Access public DNS resolvers. This means that any information contained in the EDNS packets forwarded from the VA are encrypted by DNSCrypt and cannot be intercepted. For optimum protection, this feature is enabled by default.
Unencrypted traffic is considered a problem that should be resolved. When encryption can not be established between your VA and the Secure Access DNS servers, Secure Access displays a warning. Encryption is established with a probe sent on port 53 (UDP/TCP) to 208.67.220.220 and 208.67.222.222 and if you have a firewall or IPS/IDS doing deep packet inspection and expecting to see only DNS traffic, the probe may fail.
If the probe fails, it is retried on 443 (UDP/TCP) and then on 5353 (UDP). Thus, the encrypted packets may not match the expected traffic on that port. Review your firewall configuration if that is the case and open a case with Support if you believe that you are allowing this traffic.