FortiGate 100F DNS forward

[fabio0775]

Hi,

I am new to fortigate firewalls, I would like to use my two fortigade F100s as DNS forwarders for my network's public FQDN requests.
Basically on my clients I have configured my AD servers as DNS. I would like to make sure that if my clients ask to resolve my domain names the answers come from my Domain Controllers, instead if I want to resolve public names my Domain Controllers would like them to pass the requests to the Fortigate which in turn request externally the resolution.
It's possible?

[Yurisk]

Your question is more about AD DC DNS functionality - if your clients in LAN get AD DC as their DNS server, what this DC server does with the DNS requests can be managed only by the server, not much by Fortigate.

If you were to set Fortigate as DNS server for the LAN's clients, then you'd be able to create DNS zone file for your AD domain in the FOrtigate, and forward all requests for this internal domain to the AD DC  (command "set forward <IP address>"). In such case all requests for the internal domain would be forwarded by the Fortigate to the DC, while querying DNS servers set in the system settings of the FGT for all other (Internet) domains. 

You can look how to configure it here, depending on your FOrtiOS version it may or may not be doable in GUI, but always is possible in CLI: https://community.fortinet.com/t5/Fortinet-Forum/DNS-zone-forwarding/m-p/127920?m=123751

HTH