Troubleshooting Tip: Unable to browse website when using internal DNS server

SassiVeeran · ‎10-17-2024

Description

This article describes how to troubleshoot if the internal DNS server fails to resolve any FQDN.

Scope

FortiGate, Window Server.

Solution

Problem Statement:

FortiGate is configured with an internal DNS (primary) server and a FortiGuard server (secondary).
Internal users are unable to browse the specific website www.bsp.gov.ph, while other public websites such as Google, and YouTube which is accessible.
Internal traffic is not affected.
Packet capture in FortiGate only shows the syn packet sent, but no return syn-ack from the website for the URL. The DNS queries are sent to the internal DNS server.
The machine is configured with internal DNS. Ping the URL www.bsp.gov.ph its request timeout, whereas NSLOOKUP resolves to a single IP address.
If specifying DNS to 8.8.8.8 in the user machine, the website is accessible, and NSLOOKUP resolves to multiple IP addresses.

Solution:

It seems the problem with the internal DNS server either it cannot resolve the URL correctly or does not have a record for the DNS query that it received for the URL.
In this case, adding a secondary forwarder to the DNS server will resolve the issue. Forwarders are DNS servers that this server can use to resolve DNS queries for records that this server cannot resolve.

DNS forwarder.JPG