FortiGate DNS server

You can create local DNS servers for your network. Depending on your requirements, you can either manually maintain your entries (primary DNS server), or use it to refer to an outside source (secondary DNS server).

A local, primary DNS server requires that you to manually add all URL and IP address combinations. Using a primary DNS server for local services can minimize inbound and outbound traffic, and access time. Making it authoritative is not recommended, because IP addresses can change, and maintaining the list can become labor intensive.

A secondary DNS server refers to an alternate source to obtain URL and IP address combinations. This is useful when there is a primary DNS server where the entry list is maintained.

FortiGate as a DNS server also supports TLS and HTTPS connections to a DNS client. See DNS over TLS and HTTPS for details.

By default, DNS server options are not available in the FortiGate GUI.

To enable DNS server options in the GUI:
  1. Go to System > Feature Visibility.
  2. Enable DNS Database in the Additional Features section.
  3. Click Apply.

Example configuration

This section describes how to create an unauthoritative primary DNS server. The interface mode is recursive so that, if the request cannot be fulfilled, the external DNS servers will be queried.

To configure FortiGate as a primary DNS server in the GUI:
  1. Go to Network > DNS Servers.
  2. In the DNS Database table, click Create New.
  3. Set Type to Primary.
  4. Set View to Shadow.

    The View setting controls the accessibility of the DNS server. If you select Public, external users can access or use the DNS server. If you select Shadow, only internal users can use it.

  5. Enter a DNS Zone, for example, WebServer.
  6. Enter the Domain Name of the zone, for example,
  7. Enter the Hostname of the DNS server, for example, Corporate.
  8. Enter the Contact Email Address for the administrator, for example,
  9. Disable Authoritative.

  10. Add DNS entries:
    1. In the DNS Entries table, click Create New.
    2. Select a Type, for example Address (A).
    3. Set the Hostname, for example

    4. Configure the remaining settings as needed. The options vary depending on the selected Type.
    5. Click OK.
  11. Add more DNS entries as needed.
  12. Click OK.
  13. Enable DNS services on an interface:
    1. Go to Network > DNS Servers.
    2. In the DNS Service on Interface table, click Create New.
    3. Select the Interface for the DNS server, such as wan2.
    4. Set the Mode to Recursive.