Plusnet Safeguard is blocking updates for Android phones from ota.googlezip.net

[#1]

My pixel phone running Android wants to receive its updates from ota.googlezip.net

However Plusnet Safeguard is blocking this domain meaning no Android phones are receiving updates

# dig +nostats ota.googlezip.net @213.120.234.42

; <<>> DiG 9.11.5-P4-5.1+deb10u6-Debian <<>> +nostats ota.googlezip.net @213.120.234.42
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1942
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;ota.googlezip.net. IN A

;; ANSWER SECTION:
ota.googlezip.net. 27 IN A 81.130.111.239

# dig +nostats ota.googlezip.net @213.120.234.42

; <<>> DiG 9.11.5-P4-5.1+deb10u6-Debian <<>> +nostats ota.googlezip.net @213.120.234.42
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23130
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;ota.googlezip.net. IN A

;; ANSWER SECTION:
ota.googlezip.net. 30 IN A 81.130.111.239

Wheras the non safeguard DNS servers are giving the correct (unblocked) address

# dig +nostats ota.googlezip.net @212.159.13.49

; <<>> DiG 9.11.5-P4-5.1+deb10u6-Debian <<>> +nostats ota.googlezip.net @212.159.13.49
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30263
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ota.googlezip.net. IN A

;; ANSWER SECTION:
ota.googlezip.net. 32473 IN A 216.239.32.112

Please can you fix?

Thanks

[#2]

In order to make updates work for my phone I needed to unblock these two websites

• ota.googlezip.net
• ota-cache1.googlezip.net

It seems the whole *.googlezip.net domain is blocked

[#3]

I wonder if it's something to do with Chrome's Data Saver feature which I believe proxies web traffic through the domain compress.googlezip.net.

Obviously, a content filter like Safeguard is going to discrimninate against proxy server addresses and 'rightfully' block them. Perhaps the OTA's are getting inadvertently wrapped up in this?

[#4]

Yes, I think you are right.

The Safeguard blocking needs to be a bit more focussed and just block `compress.googlezip.net` and not `*.googlezip.net` which it does at the moment which blocks the OTA updates.

It probably needs to block `check.googlezip.net` and `proxy.googlezip.net` too according to a few minutes of web searching.