AI Threat Detection blocks authenticate.pomerium.app

NextDNS's AI Threat Detection blocks authenticate.pomerium.app, Pomerium's hosted authentication service. This breaks sign-in to applications that use it. Please review this as a false positive.

On October 16, direct DNS-over-HTTPS queries to NextDNS with my profile returned 0.0.0.0 for IPv4 and :: for IPv6. Both responses explicitly said:

EDE: 17 (Filtered): (Blocked by NextDNS: ai-threat-detection)

NextDNS without a profile returned 130.211.16.180. Google DNS, Cloudflare Security, Quad9, and AdGuard DNS returned the same address. Connecting to that address with the correct hostname returned HTTP 200 with a valid TLS certificate. The block reproduces directly against NextDNS, without querying my router.

My retained logs show blocked requests as early as September 26, 2026 at 8:58 AM Pacific. September 17 and 18 requests are not marked blocked. I cannot establish the exact start date or whether a settings change caused the difference.

Why was this hostname flagged, and when did the classification start? Please correct it if this is a false positive.

Pomerium documents the service here: https://www.pomerium.com/docs/get-started/fundamentals/core/get-started

DNS reproduction details are in the GitHub report I filed: https://github.com/nextdns/metadata/issues/1495