Fortigate 100D Fortios 5.4.1 Deny: DNS error

Do you have any layer 7 applied to the policy that is letting DNS out?

Here is the Answer from Fortinet.

Dear customer,  Thank you for contacting Fortinet Technical Support.  My name *** and I will assist you with this issue.  You will see the following errors if the conditions are met:  1. DNS Queries -- DNS query returns anything but NOERROR.  "action" in log is "dns"  By design FortiGate looks for invalid/failed DNS traffic and will mark it as action=dns or in the GUI as "Action Deny: DNS error".  This happens if the DNS query is not successful returns any other status than NOERROR.  This is an expected behavior in version 5.4 where the firewall logs any invalid DNS traffic.  The firewall action itself is allow/pass, but the bad reply from the server is not forwarded back to the requesting client thus showing the "Deny: DNS Error" message.  ---  2. Host not reachable -- If trying to reach an IP address that do not respond.  "action" in log is "ip-conn"  ---  In both cases of your logs the connection actually allowed by the firewall, for DNS you receive anything but NOERROR and for IP connection error, the destination host does not respond.  Please let me know whether you need further assistance or the ticket can be closed. 

After that i did some Traffic Capture and we looked on it.

in deed there were many errors because of for example a DNS Suffix. 

I created some new security sensors to replace the ones that I already had and it resolved the issues in my case.