DNS rewrite can only be configured on a NAT rule with which type of destination...

Comprehensive and Detailed 150 to 250 words of Explanation From Palo Alto Networks Network Security Analyst Knowledge:

In Palo Alto Networks PAN-OS, the DNS rewrite feature (often referred to as DNS Doctoring) is specifically designed to solve the issue of split-horizon DNS in environments where internal users must access an internal server using its public IP address. This occurs when the DNS server returns the public IP address of a server to an internal client, but the client and server are on the same or related internal networks.

The firewall can only perform a DNS rewrite when a Static IP destination NAT rule is in place. When this option is enabled, the firewall monitors DNS responses passing through it. If a DNS response contains an IP address that matches the "Original Destination" IP in a static NAT rule, the firewall rewrites the DNS payload to the "Translated Destination" IP (the private IP of the server).

This functionality is restricted to Static IP translation because it requires a 1-to-1, predictable mapping between the public and private addresses. Dynamic translation types (A, B, and D) involve pools of addresses or port-overloading, which makes it impossible for the firewall to determine which specific internal IP address should be written into the DNS response at any given time. By ensuring a static mapping, the Network Security Analyst guarantees that internal clients receive the correct internal IP address to reach their destination without hair-pinning traffic unnecessarily through the public interface.