| Solution |
In certain scenarios, users may observe that DNS filtering does not effectively block access to websites that should fall under restricted categories. This behavior typically occurs when a browser issues both standard A-type DNS queries and newer HTTPS DNS (qtype 65) queries during the resolution process.
For example, when a user attempts to access a website in a browser, the following sequence may occur:
- The browser simultaneously sends out traditional A-type DNS queries and DNS-over-HTTPS (DoH) queries for the domain.
- The A-type query returns an IP address that is correctly identified by DNS filtering and subsequently blocked according to policy.
- However, the HTTPS DNS query may return a CNAME record pointing to a different domain commonly hosted on a content delivery network (CDN) or cloud service.
- The client then resolves this new CNAME target using both HTTPS and A-type queries.
- The A-type response for the CNAME target returns a new IP address, which the client uses to complete the connection.
- If the CNAME target is categorized as a neutral domain (e.g., "Content Servers"), DNS filtering allows the request, and access to the originally blocked site proceeds indirectly.
This behavior occurs because, in older FortiOS versions, DNS filtering does not inspect or categorize DNS queries of type HTTPS (qtype 65). These queries bypass filtering entirely, even if the resolved domains ultimately serve restricted content.
Enhancement in DNS Filtering Support:
Starting with v7.2.11, v7.4.8, and v7.6.1, FortiGate introduces support for DNS filtering of HTTPS (type 65) queries, enabling accurate categorization and enforcement for domains resolved through this newer query type.
FortiGuard will now be able to enforce policies against domains resolved through all supported DNS query types, closing the gap introduced by modern browsers and DNS resolver behavior.
To benefit from these enhancements, upgrade the FortiGate to one of the following firmware versions or later:
Related article:
Technical Tip: DNS Filter logs with "Query Type: Unknown - Query Type Value: 65" |
