Skip to main content
johnathan
Staff
johnathan
Staff
August 27, 2025

Troubleshooting Tip: DNS filter is giving rating errors, even though there is connectivity to the SDNS servers

  • August 27, 2025
  • 0 replies
  • 581 views
Description This article describes a scenario where the SDNS servers are replying to the FortiGate for DNS ratings, yet the DNS filter is still reporting rating errors
Scope FortiOS, DNS filter
Solution

When looking at the logs for the DNS filter, and queries are getting blocked due to rating errors, this is usually a network related issue. If it is possible to see the SDNS server reply in a PCAP/sniffer and this error is still seen, the FortiGate may be hitting a unique scenario.

The way that the FortiGate receives DNS ratings is via a TXT record included on the DNS response from the SDNS server.

The following screenshot is an example of this response, with the TXT record included:

 

working resp.png


The following is an example of the response in a non-working scenario:

 

notworking2.PNG

 

It is possible to see that the TXT record is missing. This can be caused if the ISP or a device in between the FortiGate and the internet are doing some sort of DNS inspection, and are stripping this record off the response. 
    Terms & ConditionsAccessibility statement