Technical Tip: DNS Filter logs with 'Query Type: Unknown - Query Type Value: 65'
Description
This article describes why, when working with a DNS Filter, the administrator might come across some DNS Filter logs marked with 'Query Type: Unknown - Query Type Value: 65'.
Query type 65 relates to HTTPS DNS records which are fairly recent and not yet a RFC Standard, as they are still in the Proposed Standard status:
Scope
FortiOS.
Solution
Here is a practical example, performing a HTTPS DNS request on a Linux machine using FortiGate as a Gateway with DNS filter enabled:
root@ubuntu-srv:~# kdig outlook.office365.com -t TYPE65
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 6069
;; Flags: qr rd ra; QUERY: 1; ANSWER: 3; AUTHORITY: 1; ADDITIONAL: 0
;; QUESTION SECTION:
;; outlook.office365.com. IN HTTPS
;; ANSWER SECTION:
outlook.office365.com. 59 IN CNAME ooc-g2.tm-4.office.com.
ooc-g2.tm-4.office.com. 59 IN CNAME outlook.ms-acdc.office.com.
outlook.ms-acdc.office.com. 59 IN CNAME CDG-efz.ms-acdc.office.com.
;; AUTHORITY SECTION:
ms-acdc.office.com. 59 IN SOA ns1-ms-acdc.office.com. hostmaster.microsoft.com. 2036437040 900 600 86400 60
Log generated:
date=2024-02-12 time=15:42:32 eventtime=1707752552867297278 tz="+0000" logid="1501054802" type="utm" subtype="dns" eventtype="dns-response" level="notice" vd="PROD" policyid=13
poluuid="e61d31e2-c9ba-51ee-249d-f65b553fd18e" policytype="policy" sessionid=13161328 srcip=192.168.5.4 srcport=49334 srccountry="Reserved" srcintf="internal" srcintfrole="undefined"
dstip=1.1.1.1 dstport=53 dstcountry="Australia" dstintf="npu0_vlink1" dstintfrole="undefined" proto=17 profile="default" srcmac="b6:e0:31:37:ca:73" xid=6069 qname="outlook.office365.com"
qtype="Unknown" qtypeval=65 qclass="IN" msg="Domain is monitored" action="pass" cat=255 catdesc="Unknown"
This behavior does not pose a security threat, as performing a HTTPS query to a malicious domain is still redirected to block portal:
root@ubuntu-srv:~# kdig devcisco.com -t TYPE65
;; WARNING: response timeout for 1.1.1.1@53(UDP)
;; WARNING: malformed reply packet (trailing data)
;; ->>HEADER<<- opcode: QUERY; status: SERVFAIL; id: 33847
;; Flags: qr rd; QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 0
;; QUESTION SECTION:
;; devcisco.com. IN HTTPS
;; Received 32 B
;; Time 2024-02-12 15:29:43 UTC
;; From 1.1.1.1@53(UDP) in 1047.7 ms
DNS filter log:
date=2024-02-12 time=15:29:43 eventtime=1707751784070802178 tz="+0000" logid="1501054601" type="utm" subtype="dns" eventtype="dns-response" level="warning" vd="PROD" policyid=13
poluuid="e61d31e2-c9ba-51ee-249d-f65b553fd18e" policytype="policy" sessionid=13156172 srcip=192.168.5.4 srcport=58520 srccountry="Reserved" srcintf="internal" srcintfrole="undefined"
dstip=1.1.1.1 dstport=53 dstcountry="Australia" dstintf="npu0_vlink1" dstintfrole="undefined" proto=17 profile="default" srcmac="b6:e0:31:37:ca:73" xid=33847 qname="devcisco.com"
qtype="Unknown" qtypeval=65 qclass="IN" msg="Domain was blocked by dns botnet C&C" action="redirect" botnetdomain="devcisco.com" rcode=2
