Basic DNS server configuration example

This section describes how to create an unauthoritative primary DNS server. The interface mode is recursive so that, if the request cannot be fulfilled, the external DNS servers will be queried.

In this example, the Local site is configured as an unauthoritative primary DNS server.

To configure FortiGate as a primary DNS server in the GUI:

1. Go to Network > DNS Servers.

2. In the DNS Database table, click Create New.

3. Set Type to Primary.

4. Set View to Shadow.

   The View setting controls the accessibility of the DNS server. If you select Public, external users can access or use the DNS server. If you select Shadow, only internal users can use it.

5. Enter a DNS Zone, for example, WebServer.

6. Enter the Domain Name of the zone, for example, example.com.

7. Enter the Hostname of the DNS server, for example, corporate.

8. Enter the Contact Email Address for the administrator, for example, admin@example.com.

9. Disable Authoritative.

   

10. Add DNS entries:

    1. In the DNS Entries table, click Create New.

    2. Select a Type, for example Address (A).

    3. Set the Hostname, for example web.

       

    4. Configure the remaining settings as needed. The options might vary depending on the selected Type.

    5. Click OK.

11. Add more DNS entries as needed.

12. Click OK.

13. Enable DNS services on an interface:

    1. Go to Network > DNS Servers.

    2. In the DNS Service on Interface table, click Create New.

    3. Select the Interface for the DNS server, such as port1.

    4. Set the Mode to Recursive.

       

    5. Click OK.

To configure FortiGate as a primary DNS server in the CLI:

config system dns-database
    edit WebServer
        set domain example.com
        set type primary
        set view shadow
        set ttl 86400
        set primary-name corporate
        set contact admin@example.com
        set authoritative disable
        config dns-entry
            edit 1
                set status enable
                set hostname web
                set type A
                set ip 172.16.200.254
            next
        end
    next
end

config system dns-server
    edit port1
        set mode recursive
    next
end

To verify the configuration:

1. Send a DNS query for a DNS entry configured locally on the Local site FortiGate:

   C:\Users\demo>nslookup office.microsoft.com
   Server:  Unknown
   Address:  172.16.200.1
   Non-authoritative answer:
   Name:     web.example.com 
   Address:  172.16.200.254

   The query is resolved to the IP address configured in the shadow DNS database on the Local site FortiGate.

2. Send a DNS query for a domain that is not configured on the Local site FortiGate:

   C:\Users\demo>nslookup facebook.com
   Server:  Unknown
   Address:  172.16.200.1
   Non-authoritative answer:
   Name:    facebook.com
   Addresses:  157.240.22.35

   The query is resolved by the central DNS server.