Fortinet Community

Hi You could check out IPS for the that. See the following article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-configure-Botnet-C-C-IP-blocking/ta-p/197914?externalID=FD49610 Thanks

Basically, the request has to pass through a firewall policy. If it passes through another VDOM, it will have to pass through another policy and DNS filter can be applied. If it goes out directly to the internet from the VDOM it will not have to matc...

Yes, this is solution i was referring to. As always, it should be thoroughly tested to ensure it meets your needs.

Firstly, i cannot comment precisely on why something is a feature or not. I believe the scenario you refer to would be possible with a workaround. 1 example would be to use a second VDOM for the DNS filtering.

With explicit proxy, the FortiGate would be doing the DNS lookup and not the client. So a policy to scan DNS requests traversing the firewall wouldnt make sense.