DNS Server FortiGate

[namlh]

Hi everyone, I need help with the DNS server on Fortigate. I'm using Forti as a DNS server and currently, I'm using the recursive mode because we have a DNS database. As I understand it, the recursive mode will query the DNS database first, and if it doesn't find the record, it will forward the query to the DNS system (I've set the DNS system to 8.8.8.8). The problem is that I have some domains mapped to private IPs, and when using Forti as the DNS server in recursive mode, it cannot resolve those domains. Is there any way to fix this issue?

[ebilcari]

I think this is a DNS server behavior, if the domain exist locally all the subdomains for that domain will be searched locally, the requests will not be forwarded to the external DNS server. As a workaround you can create another/similar domain for the local DNS database.

[namlh]

Hi thanks for your answer, 

I have also thought about that method, but if there are too many domains mapped to private IPs and they change frequently, that approach is not practical because it requires too much manual work

[ebilcari]

As I know this is a limit for the standard DNS server not only a limitation of FGT.

If the network has a private DNS server configured with all this private domains you can choose to forward all the request without specifying domains in the local database of the FGT.

[namlh]

But as far as I know about the recursive mode, when it is not in the database, it will search the external DNS. Is this correct?

[ebilcari · Accepted solution]

The concept of "not in the database" is valid for the whole domain only, not for the subdomains. As long as the domain is present in the database every request for it's subdomains will not be forwarded. If the entry is not found locally it will respond with non existing domain. Take a look at this simple test:

 

[namlh]

thanks for your support, i got it with your explain