Documentation here.

Zscaler can operate in 1 of 2 ways

• Client DNS traffic is forwarded to the Zscaler trusted resolver
• As client DNS traffic is sent to the local DNS server, the Zscaler client transparently moves it into cloud and forwards it to BloxOne. If BloxOne is offline, the packet will be forwarded from Zscaler cloud to the original DNS server specified by the client (which will be RFC1918 for 99% of the time so will fail)