What is the "set authoritative disable" used for Fortigate DNS Proxy feature?

"set authoritative enable" basically means "I am the only source of information for this DNS zone, nobody else knows". If an entry does not exist in a zone set to authoritative=enable, the FortiGate will assume that the entry does not exist at all.

The difference can be primarily felt in situations where the FortiGate, or the endpoint clients, use both the DNS zones configured on the FortiGate and also forward queries for other requests.

Here's a sample scenario you can try:

config system dns-database     edit "example.com"         set domain "example.com"         # set authoritative enable # not visible because it is the default setting         config dns-entry             edit 1                 set hostname "xxx"                 set ip 127.0.0.13             next         end     next end 

Now try to ping these FQDNs from the FortiGate CLI:
exe ping xxx.example.com => resolved to 127.0.0.13

exe ping www.example.com  => host not found (!)

Now edit the DNS zone and set authoritative to "disable". After that, re-run the ping tests:

exe ping xxx.example.com => resolved to 127.0.0.13

exe ping www.example.com  => resolved to 93.184.216.34

As you can see, an authoritative zone prevents the FortiGate from checking for DNS records futher upstream, because the setting tells it that it is the only source of DNS records for that zone.