For more information:
The domain dns.msftncsi.com is used by Microsoft Windows as part of it's Network Connectivity Status Indicator tests. This helps Windows determine if the computer is connected to the internet and display the appropriate error icon if connectivity is unavailable.
OpenDNS globally whitelists this domain because it used by the underlying Windows Operating system.
When Windows looks up the IPv6 AAAA version of this record, it does however resolve to a local / private IPv6 address. This in turn triggers the OpenDNS 'Suspicious Response' protection. This will cause the Umbrella Dashboard to display a 'Suspicious Response' warning in the Reports:
msftncsi.png
This is normal Windows behavior and is no cause for concern. The domain is on our global whitelist and will not be blocked.
From: https://support.umbrella.com/hc/en-us/articles/230564127-dns-msftncsi-com-shows-in-Security-reports