GlobalProtect VPN connection fails with NextDNS despite all security and filtering features being disabled

Hello,

I am experiencing an issue with NextDNS and GlobalProtect on my daughter's school-managed iPad.

The iPad belongs to her school, so I do not have administrative control over the device and cannot install or modify system configurations. The device requires GlobalProtect VPN to access school resources.

My setup is the following:

• TP-Link router configured to use NextDNS.

• The iPad is connected to the router via Wi-Fi.

• GlobalProtect portal: gp0.infra.ecollege78.fr

The problem is that GlobalProtect is unable to connect when the router uses NextDNS DNS servers. The application reports:

"The network connection is unreachable or the gateway is unavailable."

However:

• If I switch the router back to Google DNS (8.8.8.8 / 8.8.4.4), GlobalProtect immediately works again.

• DNS resolution appears correct with NextDNS. For example, gp0.infra.ecollege78.fr resolves to the same IP address using both Google DNS and NextDNS.

• I have disabled all parental control categories.

• I have disabled all security blocking features available in my NextDNS profile.

• I have added gp0.infra.ecollege78.fr to the allowlist (whitelist).

• The GlobalProtect portal webpage is accessible from a PC connected to the same network.

Despite all of the above, GlobalProtect still fails whenever NextDNS is used.

Could you please advise whether there are any known compatibility issues with Palo Alto GlobalProtect, or if there are specific domains, DNS features, or settings that should be excluded or disabled for GlobalProtect to function correctly?

Thank you for your help.