Technical Tip: Wildcard DNS Records is not resolved in FortiGate DNS Database

Description

This article describes the behavior where FortiGate DNS servers do not currently support wildcard (*) entries in secondary or shadow zones, or in DNS database forwarding configurations.
Although wildcard entries can be stored, FortiGate does not interpret them dynamically, so queries for subdomains do not match the wildcard and may return an 'unknown host' response.

Scope

FortiOS v7.2, FortiOS v7.4, FortiOS v7.6.

Note: Starting from FortiOS v8.0.0 and later, wildcard DNS record resolution is supported in the FortiGate DNS database.

Solution

Behavior on FortiOS v7.x and earlier versions:

Wildcard DNS records are not supported in FortiOS v7.x and earlier.
Although wildcard entries can be configured in the DNS database, they are treated as literal strings and are not evaluated dynamically for subdomain matching.

Administrators may try to use a wildcard domain in the FortiGate DNS database to:

• Resolve subdomains of an internal domain, or:

• Forward DNS queries for multiple domains without changing system-wide DNS.

 
Example scenario:

• Primary DNS contains a wildcard A-record:
  
  

*.subdomain.local → 10.10.10.50 

FortiGate DNS servers will store the wildcard record, but:

• In secondary/shadow DNS, wildcard records only resolve if queried exactly as stored.

• In DNS database forwarding, wildcard entries are treated as literal names rather than applying to all subdomains.

Verification:

• To verify, check the DNS database using:
  
  

diagnose test application dnsproxy 8

• To test resolution from the FortiGate:
  
  

execute ping anything.subdomain.local

It will return Unable to resolve hostname.

Workarounds: 

1. Forward queries for the Specific Domains:

config system dns-database
    edit "subdomain.local"
        set authoritative disable
        set forwarder 10.10.10.10
    next
end

Queries for all subdomains of subdomain.local will be resolved correctly by the primary DNS server.

2. Add Explicit A-Records.

If only a few subdomains are required, manually add entries in the FortiGate DNS database:

config system dns-database
    edit "subdomain.local"
        config dns-entry
            edit "app.subdomain.local"
                set type A
                set ip 10.10.10.50
            next
        end
    next
end

Note: It is not suitable for large or dynamic sets of subdomains.

FortiOS v8.0.0 and later:

FortiOS v8.0.0 and later introduces support for wildcard DNS record resolution in the FortiGate DNS database.

In FortiOS v8.0.0 and later:

• Wildcard DNS records (e.g., *.subdomain.local) are supported.

• DNS queries matching wildcard patterns can be resolved dynamically.

• This improves flexibility for internal DNS resolution use cases.