(S)DNS server slow - users getting SSL errors

[Erik-dft]

Has anyone else had any issues with site using the DNS filters?  I have a few different sites, with different version of the firewall, all getting the same random error.  

Users are complaining that they get a SSL error on sites that should work (even outlook gets errors).  When we look at the cert, its a @*.fortinet  cert.   So looks like some type of re-direct is happening.

In the logs (DNS) I see errors that SDNS is not responding.  

When I hit the DNS tab under networking, the primary DNS server (96.45.45.45) is red with a time of 10,470ms.

Anyone else seeing anything similar?  For now I've turned of DNS filter to see if that helps.

[vtsonev]

Hello Erik,

There is currently ongoing investigation for the same topic. (high latency on our new DNS servers) . By design DNS over TLS (port 853) is expected to have higher latency than the plain DNS traffic or ICMP for example, but it shouldn't reach higher values, like in your case. (above 10,000ms)

Meanwhile you can use the following as a workaround :

config system dns
set primary 8.8.8.8
set protocol dot
set server-hostname "dns.google"
end

Can you also upload a sample of the SSL error logs that you see. I guess you would find them in the forward traffic logs on your Fortigate.

Best regards,

Vasil

[vitor-simoes]

I have the same issue, but your solution wont work for me. Only Fortiguard as DNS servers are working in my case.

[vitor-simoes]

Hey Buddy, i have the same situation happening after a firmware update to 7.2.0. Not only system DNS is showing a very high latency but for some reason i cant use other public DNS i have to keep fortiguard as DNS Server otherwise the box stop resolving names. Also using the fortigate as a DNS server became impossible, name resolutions are very slow or not happening at all.

Now using google DNS in workstations helped but now and then we are having random DNS errors and pressing F5 the site opens. Just crazy.

Dont really know what to do at the moment.