DNS Filter upon a Virtual Wire Pair Policy is broken

Hello,

I have the below configured as a rule for my Virtual Wire Pair Policy.

config firewall policy     edit 23         set name "VLAN13 Restricted DNS"         set uuid 4f872b7a-3a70-51f0-ffbb-6d2a411e5d70         set srcintf "internal4" "internal5" "internal2" "internal3"         set dstintf "internal4" "internal5" "internal2" "internal3"         set action accept         set srcaddr "VLAN13 address space"         set dstaddr "VLAN18 address space"         set schedule "always"         set service "ALL"         set utm-status enable         set dnsfilter-profile "sample-filter"         set logtraffic all     next end

With the above configuration, all DNS traffic is broken. I cannot even do the below dig command (192.168.100.1 is the IP address of this FortiGate, which is running a DNS server.

dig @192.168.100.1

If I remove the DNS Filter profile from the above, all DNS queries work fine.

My DNS filter looks like this. All I did in the GUI was to set "example.com" to Allow and then immediately after it, block all domains with an "*" wildcard. I tested this policy by applying it to the DNS service directly, and it worked completely fine there. It just seems to be broken when used on a Virtual Wire Pair Policy.

config dnsfilter profile     edit "sample-filter"         config domain-filter             set domain-filter-table 1         end         config ftgd-dns             set options error-allow ftgd-disable             config filters                 edit 1                     set category 12                 next                 edit 2                     set category 2                 next                 edit 3                     set category 7                 next                 edit 4                     set category 8                 next                 edit 5                     set category 9                 next                 edit 6                     set category 11                 next                 edit 7                     set category 13                 next                 edit 8                     set category 14                 next                 edit 9                     set category 15                 next                 edit 10                     set category 16                 next                 edit 11                     set category 57                 next                 edit 12                     set category 63                 next                 edit 13                     set category 64                 next                 edit 14                     set category 65                 next                 edit 15                     set category 66                 next                 edit 16                     set category 67                 next                 edit 17                     set category 26                     set action block                 next                 edit 18                     set category 61                     set action block                 next                 edit 19                     set category 86                     set action block                 next                 edit 20                     set category 88                     set action block                 next                 edit 21                     set category 90                     set action block                 next                 edit 22                     set category 91                     set action block                 next                 edit 23                 next             end         end         set log-all-domain enable         set redirect-portal 192.168.254.254     next  end

 I am running on v7.6.3 build3510 (Feature) on a FortiGate-60F appliance. I will take any suggestions, I am completely blocked by this issue now. My end goal is to only allow a small fine grained list of domains, and then block all other DNS traffic, so I only need to use a static domain filter here.