I was able to fix this without having TAC do some intensive backdoor actions.
Go to FTD command line
system support diagnostic-cli
enable (if needed)
show run
look for the dns policy map. Mine was similar to:
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
umbrella tag UMBRELLAPOLICY device-id 0123456789
Create a flex config object. Set it to apply once, append, and paste the policy map in with the 'no' form of the umbrella command. You don't need the message-length lines, and you don't need the device-id. UMBRELLAPOLICY will be based on your own configuration.
policy-map type inspect dns preset_dns_map
parameters
no umbrella tag UMBRELLAPOLICY
Do not remove the umbrella policy from the Access Control policy. Leave it as-is. Attach the flex config to the device, and deploy. The deploy completed for me, and the umbrella settings were effectively removed. Now remove the flex config policy from the device, set the dns umbrella policy to none, and deploy again. This got things back to normal for me.
