The wildcard FQDN object on the Sophos Firewall is properly populated with IP addresses.

If you resolve one object, does it work? Because Wildcard objects only resolve some IP, the firewall has to resolve. It will not try to resolve all domains (not possible). 

There is also a issue: https://support.sophos.com/support/s/article/KB-000044526?language=en_US

Hi,

you need to access the site before the XG will update the fqdn.

ian

Okay I got it,seems I have to buy Sophos APX to check prod.hydra.sophos.com to check IP list