Technical Tip: How the domain name external feed entries behave when used in DNS Filtering
Description
This article describes some expected behaviors and provides examples of how the FortiGate interprets entries within Domain Name External Feeds when used with DNS Filtering.
Scope
FortiGate, DNS filtering, external feeds.
Solution
As a primer, the Domain Name External Feed function allows the FortiGate to dynamically import lists of domain names hosted on external servers. These external feeds can then be utilized with DNS Filtering, where any DNS requests that match the feed's entries can have a separate action assigned compared to that domain's typical FortiGuard category. See also:
As per the above documentation, domain name external feeds support simple wildcards to allow for flexible domain matching. However, one major behavior to note is that wildcard sub-domain entries (such as *.example.com) can match sub-domains but are not necessarily expected to match the parent domain. This means that when attempting to block access to a domain and all of its associated subdomains, administrators should use a threat feed list that includes both the domain itself and a wildcard entry for that domain (e.g., example.com and *.example.com, respectively).
As a demonstration, the following table includes some example entries for a domain name external feed and a few FQDN examples that DNS Filtering would match or not match to those entries:
Domain Name External Feed Entry | Would match: | Would not match: |
|---|---|---|
example.com | example.com | www.example.com, alt.www.example.com |
*.example.com | www.example.com, alt.www.example.com | example.com |
*example.com (no dot) | example.com, fortiexample.com, www.example.com, alt.www.example.com | example2.com |
www.example.com | www.example.com | example.com, alt.www.example.com, www2.example.com |
test*.example.com | test.example.com, test1.example.com, testsite.example.com | fortitest.example.com |
docs.*example.com | docs.example.com, docs.fortiexample.com, alt.docs.example.com** | docs2.example.com |
*mail.example.com | mail.example.com, fortimail.example.com, alt.mail.example.com | mail2.example.com |
web.*.example.com | web.test.example.com, web.test1.test2.example.com, alt.web.test.example.com** | web.example.com, alt.web.example.com |
The cases noted above were observed during lab-testing with FortiOS v7.6.7 GA (both with flow-based and proxy-based inspection). These results are unexpected given the lack of a wildcard at the start of the external feed entry, and so it is possible that this behavior may change in future releases.
Related document:
