What condition causes the Cisco Umbrella resolver to forward DNS requests to the intelligent proxy?

Cisco Umbrella's intelligent proxy is activated when a domain is "grey-listed." This means the domain's reputation is uncertain; it's not definitively known to be malicious or benign. Instead of blocking access outright (which happens for block-listed domains) or allowing direct access (for known good domains), Umbrella forwards the DNS request to the intelligent proxy. The proxy then performs deeper inspection of the content, such as file scanning and URL analysis, to determine if the site poses a threat before allowing the user to access it. This proactive approach helps protect users from emerging threats and phishing attempts that haven't yet been categorized as definitively malicious.