SGOS does not use the configured forwarding policy to forward DRTR requests out to the Internet. If you have a proxy hierarchy, the child proxy will attempt to contact the DRTR servers directly via its configured gateway(s) and not using the configured forwarding host(s). If the proxy blocks the DRTR requests from the child proxy, dynamic categorization will not occur. With older versions of SGOS, there isn't any way to work around the issue. SGOS 4.2.x (verified in SGOS 220.127.116.11; may be in earlier releases of 4.2.x) and 5.2.x (verified in SGOS 18.104.22.168; may also exist in earlier versions of 5.2.x) have the ability to configure a forwarding target or SOCKS gateway target. These forwarding targets are on the same page as the "Dynamic Categorization" tab. This will allow the DRTR requests to be forwarded on to the parent ProxySG.