How to see if DNS server send a NXDOMAIN error

Hi @heyyo ,

NXDOMAIN errors are related to not existent domain. To check that you could run a packet capture and analyse traffic with wireshark on a test client.
Alternatively you can run a packet capture on the FortiGate filtering by the DNS port 53 and the DNS server IP.
Bear in mind that if the DNS traffic uses DoH (DNS over HTTPS) or DoT (DNS over TLS) you may not be able to see the pcap content.

You may try to run the following debug and check if you are able to see NXDOMAIN errors:

diag debug application dnsproxy -1
diag debug console timestamp en
diag debug en

If using DNS port 53, the best way to see the DNS response should be running the packet sniffer below and convert it to analyse it with wireshark:
diag debug sniffer any "host x.x.x.x and host y.y.y.y and port 53" 6 0 l #<-----where x.x.x.x is the client IP and y.y.y.y is the DNS server IP

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Packet-capture-sniffer/ta-p/198313

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-the-FortiOS-built-in-packet-sniffer/ta-p/194222

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-import-diagnose-sniffer-packet-data-to/ta-p/191727

Best regards,

AS the KB article you pointed to mentions that it is applicable only when using DOH/DOT, i.e. DNS traffic is being encrypted, the only way to try and see the resolving process on FGT is indeed to run debug. I am not sure about DOH/DOT traffic debug - if it has its own daemon and debug, but try starting with usual DNS proxy debug: https://github.com/yuriskinfo/cheat-sheets/blob/master/cheat-sheets/Fortigate-debug-diagnose-complete-cheat-sheet.adoc#dns-server-and-proxy-debug 

P.S. If someone knows about specific DOH/DOT debug on Forti it would make a great KB Article :)