There should be no change in this behavior between Roaming Client and Secure Client. We'll look into it though.
For Firefox, it the encrypted DNS should not kick on because of the use-application-dns.net domain as noted here: https://support.umbrella...
Your instincts are correct! There's no need to run a backup of the VAs like that. If they got corrupted somehow you'd just deploy a fresh image from the dashboard.
Looks like they are having nameserver issues. Our resolved are getting no response, and it looks like many other dns services are having the same issue with them.
I checked our internal docs, and it looks like 303 Redirect is used when SWG is implemented in a policy and it is redirecting a user to SAML auth. Do you have SIG Essentials or SIG Advantage, or is this a DNS subscription?
