DNS over TLS

DNS over TLS (DoT) is a security protocol for encrypting and wrapping DNS queries and answers via the TLS protocol. The goal of DNS over TLS is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data via man-in-the-middle attacks. There is an option in the FortiOS DNS profile settings to enforce DoT for this added security.

Before enabling DoT , ensure that it is supported by the DNS servers. The default FortiGuard DNS servers do not support DoT queries, and will drop these packets. At times, the latency status of the DNS servers might also appear high or unreachable.

Disabling DoT is recommended when it is not supported by the DNS servers.

To configure DoT in the GUI:

1. Go to Network > DNS. The DNS Settings pane opens.
2. For DNS over TLS, click Enforce.

   

3. Click Apply.

To configure DoT in the CLI:

config system dns
    set primary 8.8.8.8
    set dns-over-tls enforce
    set ssl-certificate "Fortinet_Factory"
end

FortiGuard DNS rating service

DNS over TLS connections to the FortiGuard secure DNS server is supported. The CLI options are only available when fortiguard-anycast is enabled. DNS filtering connects to the FortiGuard secure DNS server over anycast by default.

To configure DoT to the secure DNS server in the CLI:

config system fortiguard
    set fortiguard-anycast enable
    set fortiguard-anycast-source fortinet
    set anycast-sdns-server-ip 0.0.0.0
    set anycast-sdns-server-port 853
end