Technical Tip: How to troubleshoot FortiADC Global Load Balance DNS resolver issue related to the Global DNS Policy configuration

[kmak]

Description	This article describes how to troubleshoot the FortiADC Global Load Balance DNS resolver issue related to the Global DNS Policy configuration.
Scope	FortiADC.
Solution	Prerequisite: Basic understanding of the concept of FortiADC Global Load Balance Zone service. DNS zones and related objects are created for the GLB DNS resolver. The FortiADC Global DNS Policy in GLB configurations uses the source and destination traffic matching criteria to serve the DNS zone resolver service. There are a few common problems that users might be facing when configuring the policy. Multiple Global DNS Policy with both source and destination configure as 'any': When the DNS resolving request is sent to FortiADC, and the traffic criteria match the first Global DNS Policy, it does not check the subsequent Global DNS Policy, even if the DNS zone is not added to the matched policy. In the example below, there are 2 Global DNS Policy created with both source and destination configured as 'any'. The request matches the first Global DNS policy, but the DNS zone is added to the second Global DNS policy, which the FortiADC does not return any result due to the DNS zone record is not served in the matched Global DNS policy. To fix the issue, use only one Global DNS policy if there is no requirement to restrict the DNS resolver based on source/destination traffic criteria. Unable to resolve non-authoritative domains DNS result, even though recursion is enabled in General Settings: In some cases, where the organization is using the FortiADC as a DNS resolver server for all the office/branch users, it is required to enable recursion in the DNS server policy. The FortiADC administrator might have enabled recursion in the GLB General Settings, but non-authoritative domains remain unable to be resolved. Similar to the previous issue, when a non-authoritative domain's DNS resolving request traffic hits the FortiADC, it will check the source and destination to match the Global DNS Policy criteria. If the request traffic matches the GLB Global DNS policy criteria, it does not check the subsequent global DNS policy or the GLB General Settings conditions. To resolve the issue, enable the ‘recursion’ option in the Global DNS policy settings. Related document: FortiADC Global DNS Policy