Technical Tip: DNS issues and commands to use
Description
This article describes information about useful debugs related to DNS and general DNS information.
Scope
FortiGate.
Solution
DNS definition.
It is used to resolve Hostnames/Domains into Routable IP addresses. It is a hierarchical and decentralized system and usually runs on port 53.
Whenever troubleshooting DNS Issues, the CLI commands to use are:
To check General DNS settings as well as Cache/Statistics:
diagnose test application dnsproxy 2 <----- To show stats.
diagnose debug rating
diagnose test application dnsproxy 13 <----- To show hostname cache.
diagnose test application dnsproxy 14 <----- To clear hostname cache.
diagnose test application dnsproxy 1 <----- Clearing DNS cache.
diagnose test application dnsproxy
1. Clear DNS cache
2. Show stats
3. Dump DNS setting
4. Reload FQDN
5. Requery FQDN
6. Dump FQDN
7. Dump DNS cache
8. Dump DNS DB
9. Reload DNS DB
10. Dump secure DNS policy/profile
11. Dump Botnet domain
12. Reload Secure DNS setting
13. Show Hostname cache
14. Clear Hostname cache
15. Show SDNS rating cache
16. Clear SDNS rating cache
17. DNS debug bit mask
18. DNS debug obj mem
99. Restart dnsproxy worker
To check how DNS resolution is being done (debug it):
diagnose debug disable
diagnose debug reset
diagnose debug application dnsproxy -1
diagnose debug enable
execute ping <URL> --> In the FortiGate CLI, perform a ping test to any URL or external domain (e.g., google.com), or run a ping test from the end machine to generate DNS traffic.
To disable debug :
diagnose debug disable
diagnose debug reset
The following lines are the most relevant lines from the output of the DNS proxy debug
dns_local_lookup_common()-2553: vfid=0, real_vfid=0, qname=www.site.com, qtype=28, qclass=1 <----- Response received.
dns_send_cached_response()-1747: domain=www.site.com <----- Checking against cache.
dns_send_resol_request()-1344: orig id: 0x44b4 domain=www.site.com <----- If cache misses, it is forwarded towards upstream DNS.
dns_query_handle_response()-2743: domain=www.site.com pktlen=222 <----- Received response from upstream DNS.
dns_send_response()-1645: domain=www.site.com reslen=222 <----- Response to Client.
To check general things: check if it is using DNS over TLS or HTTPS:
config system dns
show
set dns-over-tls disable
config system dns-database
show
As of v7.0.0, verify if the DNS protocol is DoT or DoH as below:
config system dns
show
set primary 1.1.1.1
set secondary 8.8.8.8
set protocol dot <-
To troubleshoot the DNS server unreachable:
Ensure FortiGuard is pingable:
config system fortiguard
set fortiguard-anycast disable
set protocol udp
set port 53 (or 8888)
set sdns-server-ip "208.91.112.220" -> US server.
end
By default, the interface selection is set to 'auto' in DNS configuration:
v7.0.0 and above, 'diagnose test application dnsproxy 15' will not show SDNS cache results because dnsfilter in flow mode is handled by the IPS engine. If changing to proxy mode, the results will be displayed.
It can be changed from the CLI as well as the GUI. See the following articles:
Technical Tip: How to specify outgoing interface for local DNS traffic
Technical Tip: Change/specify the outgoing interface for DNS traffic in GUI
Common issue:
Short DNS TTL: If a DNS server returns a very short TTL (e.g., 10-30 seconds):
- The cached IP may expire.
- The FortiGate may not refresh immediately.
Result:
- The FQDN object temporarily has no IP.
- Firewall polices using the object may fail.
config firewall address
edit "example_fqdn"
set type fqdn
set fqdn "app.example.com"
set cache-ttl 3600
next
end
config system dns
set fqdn-min-refresh 10
set fqdn-max-refresh 600
end
Related articles:
Technical Tip: FortiGate Troubleshooting DNS commands
Technical Tip: Different options of configuring DNS server on FortiGate
Technical Tip: Configuring FortiGates as DNS servers in Master/Slave relationship