Hello @AllenWu,
This might be dependent on what DNS servers you’re using. Are you seeing this behavior in nslookup or using something else? If the example you’re testing or seeing this behavior with is publicly available feel free to DM me and I’m happy to take a look.
That being said, in general even with DNS Security Netskope should respond back with the appropriate response unless we take policy action on it. This response is based on using public resolvers unless you specify a separate resolver for us to use.