Troubleshooting tip: Internal DNS queries are not resolved when FortiGate is used as a DNS server

Follow the steps in this document to configure FortiGate as a DNS server FortiGate DNS server | FortiGate / FortiOS 7.6.4 | Fortinet Document Library.

To configure a DNS server, go to Network -> DNS Servers. If the option is not visible, go to System -> Feature Visibility and enable DNS Database in the Additional Features section.

From the CLI:

config system dns-server

    edit "port2"

    next

end

Verify that the DNS entry is properly configured on FortiGate to resolve internal DNS queries. To do so, go to Network -> DNS Servers and double-click on the DNS database.

From the CLI:

config system dns-database
    edit "TAC"
        set domain "tac.local"
            config dns-entry
                edit 1

                    set hostname "test"

                    set ip 192.168.100.1

                next

            end

        next

    end

From the client side, DNS is resolved for public DNS queries but not internal ones.


This happens due to the DNS zone being set to 'public' instead of 'shadow'. Refer to this document for more information regarding the different view types in a DNS zone: Technical Tip: DNS Database view type Shadow and Public for explicit proxy.

To verify the view type, go to Network -> DNS Servers and double-click on the DNS database.


Switch the view type to 'shadow' and confirm internal DNS queries are resolvable.

Related articles:
Technical Tip: FortiGate Troubleshooting DNS commands

Technical Tip: DNS server on FortiGate caused FortiGate DNS latency

Technical Tip: DNS troubleshooting

Technical Tip: DNS stops working when using custom DNS

Technical Tip: FortiGate DNS Server works as DNS proxy

Technical Tip: DNS server is unreachable when using custom DNS 
Technical Tip: DNS over TLS (DoT) with 3rd Party Global DNS (Google DNS)

Technical Tip: Enable DNS over TLS with Google DNS servers
Technical Tip: Different options of configuring DNS server on FortiGate

Troubleshooting Tip: Using Cloudflare DNS with DNS over TLS showing as unreachable 

Troubleshooting Tip: Google DNS with DNS over TLS showing as unreachable

Troubleshooting Tip: Domain Name ServDNS not responding

Troubleshooting Tip: Quad9 DNS with DNS over TLS showing as unreachable