Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Websites blocking on Android

Hello, I am having a problem with Fortigate.


It seems like some websites are being blocked only on Android, when I use a laptop or Ios everything is working fine. When I try to see the logs I can't see that a website is being blocked.


I would apprentice any help.

Honored Contributor

Do you have AppControl active on your internet policies? Then the App Signatures may cause that...


"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

New Contributor

Thanks for the reply. Yes AppControl is active. By going on Chrome settings and changing the Use Secure DNS to Google (Public DNS) instead of current service DNS the websites that were being blocked are working.


Is it possible to fix this issue from Fortigate please? Instead of having to change the Secure DNS from Chrome. Thank you.

New Contributor

On Fortigate by switching off TLS and switching on DNS from DNS settings solved the issue. I am not sure if this will effect other things.




Can you please elaborate what you are referring to by switch off TLS on FortiGate side?

New Contributor

Hello, I used the setting below. Before only TLS was switched on.




Please help us with DNS packet captures to see what is happening when you use TLS protocol for DNS service.

# diag sniffer packet any "(host <Android user IP address> or host <public IP address on the FGT) and port 853" 6 0 a   ---------------ctrl+c to stop the pcap




As you informed after switching on DNS (UDP/53) from DNS settings you are able to access the website.


DNS primarily uses the UDP protocol on port 53 to serve the address resolve requests.

The FortiGate DNS Filter inspects the UDP protocol on port 53 traffic that traverse FortiGate, and based on the DNS Filter profile configuration, makes the Allow/Monitor/Block or Redirect decision for the inspected traffic.

DNS over TLS (DoT) is a security protocol for encrypting and encapsulating DNS queries and responses over the TLS protocol. DoT increases user privacy and security by preventing eavesdropping and manipulation of DNS data via man-in-the-middle attacks.

Before enabling DoT or DoH, ensure that they are supported by the DNS servers. The legacy FortiGuard DNS servers ( and do not support DoT or DoH queries, and will drop these packets. Disabling DoT and DoH is recommended when they are not supported by the DNS servers.


Please refer to the below documents for more understanding:

Top Kudoed Authors