cache {enable | disable}

Enable to cache DNS query results to improve performance.

Disable the DNS cache to free memory if the FortiMail system has high RAM usage.

cache-min-ttl <seconds_int>

Enter the time-to-live (TTL) until expiry of cached DNS records.

Whether the TTL is applied to existing cache depends on the length of the existing TTL:

• New TTL is longer — Apply the new TTL to existing cache entries, extending their TTL.

• New TTL is shorter — Keep the old TTL on existing cache entries. Later, when the record is cached again, apply the new TTL to the new cache.

primary {<dns1_ipv4> | <dns1_ipv6>}

Enter the IP address of the primary DNS server.

This setting is ignored if dns-override-status {enable | disable} is enabled.

protected-domain-dns-servers {{<dns_ipv4> | <dns_ipv6>} ...}

Enter the IP address of a DNS server that you want to use to resolve protected domain and sub-domain names and the MX record (alternative domain). You can enter up to three addresses.

protected-domain-dns-state {enable | disable}

Enable or disable DNS servers that are specifically used for protected domains and their sub-domains. This is useful if the protected domains’ MX record, A record, or AAAA record are resolved differently on internal DNS servers.

This setting applies only if operating in gateway mode and transparent mode, and if relay-type {host | ip-pool | ldap-domain-routing | mx-lookup | mx-lookup-alt-domain} is mx-lookup or mx-lookup-alt-domain.

If you configure DNS servers for protected domains (such as example.com), FortiMail will also use the same DNS server for all queries that are in the form of sub.example.com, so that the recursive queries for the returned MX record or other records can be directed to the same server.

ptr-query-option {enable | disable | public-ip-only}

Enable to perform reverse DNS lookups on both private network IP addresses and public IP addresses.

DNS pointer record (PTR) queries may cause delays when the DNS server has no response. In this situation, you can disable the query.

In some cases, the DNS server may not have PTR records for your private network’s IP addresses. Failure to contain records for those IP addresses may increase DNS query time. In this situation, you can query on public IP addresses only.

secondary {<dns2_ipv4> | <dns2_ipv6>}

Enter the IP address of the secondary DNS server.

This setting is ignored if dns-override-status {enable | disable} is enabled.