Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • CLI Reference

    6.4.2
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.16
    7.0.15
    7.0.14
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.15
    6.4.14
    6.4.13
    6.4.12
    6.4.11
    6.4.10
    6.4.9
    6.4.8
    6.4.7
    6.4.6
    6.4.5
    6.4.4
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.2.16
    6.2.15
    6.2.14
    6.2.13
    6.2.12
    6.2.11
    6.2.10
    6.2.9
    6.2.8
    6.2.7
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.0.0
    5.6.0
    5.4.0
    5.2.0
    5.0.0

    system dns

    Configure DNS.

      config system dns
      Description: Configure DNS.
      set primary {ipv4-address}
      set secondary {ipv4-address}
      set dns-over-tls [disable|enable|...]
      set ssl-certificate {string}
      set server-hostname <hostname1>, <hostname2>, ...
      set domain <domain1>, <domain2>, ...
      set ip6-primary {ipv6-address}
      set ip6-secondary {ipv6-address}
      set timeout {integer}
      set retry {integer}
      set dns-cache-limit {integer}
      set dns-cache-ttl {integer}
      set cache-notfound-responses [disable|enable]
      set source-ip {ipv4-address}
      set interface-select-method [auto|sdwan|...]
      set interface {string}
  end

    config system dns

    Parameter Name Description Type Size
    primary Primary DNS server IP address. ipv4-address Not Specified
    secondary Secondary DNS server IP address. ipv4-address Not Specified
    dns-over-tls Enable/disable/enforce DNS over TLS.
    disable: Disable DNS over TLS.
    enable: Use TLS for DNS queries if TLS is available.
    enforce: Use only TLS for DNS queries. Does not fall back to unencrypted DNS queries if TLS is unavailable.
    		 option -
    ssl-certificate Name of local certificate for SSL connections. string Maximum length: 35
    server-hostname <hostname> DNS server host name list.
    DNS server host name list separated by space (maximum 4 domains).    		 string Maximum length: 127
    domain <domain> Search suffix list for hostname lookup.
    DNS search domain list separated by space (maximum 8 domains).    		 string Maximum length: 127
    ip6-primary Primary DNS server IPv6 address. ipv6-address Not Specified
    ip6-secondary Secondary DNS server IPv6 address. ipv6-address Not Specified
    timeout DNS query timeout interval in seconds (1 - 10). integer Minimum value: 1 Maximum value: 10
    retry Number of times to retry (0 - 5). integer Minimum value: 0 Maximum value: 5
    dns-cache-limit Maximum number of records in the DNS cache. integer Minimum value: 0 Maximum value: 4294967295
    dns-cache-ttl Duration in seconds that the DNS cache retains information. integer Minimum value: 60 Maximum value: 86400
    cache-notfound-responses Enable/disable response from the DNS server when a record is not in cache.
    disable: Disable cache NOTFOUND responses from DNS server.
    enable: Enable cache NOTFOUND responses from DNS server.
    		 option -
    source-ip IP address used by the DNS server as its source IP. ipv4-address Not Specified
    interface-select-method Specify how to select outgoing interface to reach server.
    auto: Set outgoing interface automatically.
    sdwan: Set outgoing interface by SD-WAN or policy routing rules.
    specify: Set outgoing interface manually.
    		 option -
    interface Specify outgoing interface to reach server. string Maximum length: 15
    Previous
    Next

    system dns

    Configure DNS.

      config system dns
      Description: Configure DNS.
      set primary {ipv4-address}
      set secondary {ipv4-address}
      set dns-over-tls [disable|enable|...]
      set ssl-certificate {string}
      set server-hostname <hostname1>, <hostname2>, ...
      set domain <domain1>, <domain2>, ...
      set ip6-primary {ipv6-address}
      set ip6-secondary {ipv6-address}
      set timeout {integer}
      set retry {integer}
      set dns-cache-limit {integer}
      set dns-cache-ttl {integer}
      set cache-notfound-responses [disable|enable]
      set source-ip {ipv4-address}
      set interface-select-method [auto|sdwan|...]
      set interface {string}
  end

    config system dns

    Parameter Name Description Type Size
    primary Primary DNS server IP address. ipv4-address Not Specified
    secondary Secondary DNS server IP address. ipv4-address Not Specified
    dns-over-tls Enable/disable/enforce DNS over TLS.
    disable: Disable DNS over TLS.
    enable: Use TLS for DNS queries if TLS is available.
    enforce: Use only TLS for DNS queries. Does not fall back to unencrypted DNS queries if TLS is unavailable.
    		 option -
    ssl-certificate Name of local certificate for SSL connections. string Maximum length: 35
    server-hostname <hostname> DNS server host name list.
    DNS server host name list separated by space (maximum 4 domains).    		 string Maximum length: 127
    domain <domain> Search suffix list for hostname lookup.
    DNS search domain list separated by space (maximum 8 domains).    		 string Maximum length: 127
    ip6-primary Primary DNS server IPv6 address. ipv6-address Not Specified
    ip6-secondary Secondary DNS server IPv6 address. ipv6-address Not Specified
    timeout DNS query timeout interval in seconds (1 - 10). integer Minimum value: 1 Maximum value: 10
    retry Number of times to retry (0 - 5). integer Minimum value: 0 Maximum value: 5
    dns-cache-limit Maximum number of records in the DNS cache. integer Minimum value: 0 Maximum value: 4294967295
    dns-cache-ttl Duration in seconds that the DNS cache retains information. integer Minimum value: 60 Maximum value: 86400
    cache-notfound-responses Enable/disable response from the DNS server when a record is not in cache.
    disable: Disable cache NOTFOUND responses from DNS server.
    enable: Enable cache NOTFOUND responses from DNS server.
    		 option -
    source-ip IP address used by the DNS server as its source IP. ipv4-address Not Specified
    interface-select-method Specify how to select outgoing interface to reach server.
    auto: Set outgoing interface automatically.
    sdwan: Set outgoing interface by SD-WAN or policy routing rules.
    specify: Set outgoing interface manually.
    		 option -
    interface Specify outgoing interface to reach server. string Maximum length: 15
    Previous
    Next