Configure DNS Security and Threat Prevention on a FortiGate (FortiOS 7.x)

Before you run this

This guide configures the FortiGate's own DNS resolver to use FortiGuard servers, builds a DNS Filter security profile (FortiGuard category blocking, botnet C&C domain blocking, and an optional static domain block list), and applies that profile to an outbound firewall policy. The purpose is to stop clients from resolving known-malicious, botnet, and unwanted-category domains before a connection is ever made.

You need super_admin / read-write administrator access to the FortiGate — via the HTTPS GUI and/or an SSH CLI session. DNS category filtering and botnet domain blocking are FortiGuard-licensed features; without an active subscription the profile will apply but categories won't be rated.

This changes how name resolution and outbound policy behave for everyone behind the affected policy. A DNS filter that blocks the wrong category, or a resolver change that points at an unreachable server, can break name resolution for the whole network. So:

• Keep a separate out-of-band / console connection open (the physical console port or a management interface on a policy you are not editing). A bad policy or a broken resolver can cut both production traffic and your GUI session.
• Back up the running config before you touch anything (below). Restoring that backup is your rollback path.
• Make the change in a maintenance window, and test the profile against a single test policy or a lab FortiGate / VM before rolling it to your main outbound policy.
• Read every command before you paste it. Category IDs and profile names differ between environments — substitute your own.

Assumptions for this guide: FortiOS 7.4.x, a single FortiGate, profile-based (NGFW) inspection, one outbound internal → wan policy, and an active FortiGuard licence. Menu paths and a couple of CLI keywords moved in earlier 7.0/7.2 builds — if a path differs, check the FortiOS 7.4 Administration Guide.

Step 1 — Back up the running configuration

GUI: Dashboard → System (top-right admin menu) → Configuration → Backup, save to your local PC.

Or over CLI/SSH:

execute backup config flash dns-baseline

This writes a restore point to internal storage; still take the file backup too, because a flash slot can be overwritten.

Step 2 — Point the FortiGate resolver at FortiGuard DNS

Using FortiGuard's own resolvers means the box's lookups are rated and consistent with the filter.

config system dns
    set primary 96.45.45.45
    set secondary 96.45.46.46
end

96.45.45.45 and 96.45.46.46 are FortiGuard's public DNS servers.

DNS over TLS (optional): FortiOS 7.4 can encrypt the FortiGate's own resolver traffic to FortiGuard. The setting lives inside config system dns, but the exact keyword and the FortiGuard DoT server hostname vary by build — do not guess it. Confirm the current keyword and hostname in the FortiOS 7.4 Administration Guide ("DNS over TLS and HTTPS") before enabling, then set it there. Leave DNS cleartext until you've verified resolution still works.

Confirm the resolver is answering:

get system dns
execute ping globalsdns.fortinet.net

Step 3 — Build the DNS Filter profile

If Security Profiles → DNS Filter isn't visible in the GUI, enable it under System → Feature Visibility → DNS Filter, then save.

GUI (recommended for choosing categories)

1. Security Profiles → DNS Filter.
2. Click Create New, name it e.g. corp-dns-filter.
3. Turn on FortiGuard Category Based Filter. Set the categories you want to Block — at minimum the security-oriented ones (Malicious Websites, Phishing, Newly Registered Domains, Spam URLs). Leave everything else on Allow or Monitor to start; Monitor logs without blocking, which is the safest first pass.
4. Enable Redirect botnet C&C requests to Block Portal (this is the botnet C&C domain database).
5. Leave Allow DNS requests when a rating error occurs enabled unless you have a reason not to — otherwise a FortiGuard lookup failure blocks resolution.
6. Click OK.

Choosing categories by name in the GUI avoids the risk of mapping the wrong numeric category ID.

CLI equivalent

The framework, so you can see what the GUI writes:

config dnsfilter profile
    edit "corp-dns-filter"
        set block-botnet enable          # redirect botnet C&C lookups
        config ftgd-dns
            config filters
                edit 1
                    set category <id>    # FortiGuard category ID — set in GUI, or look up in the admin guide
                    set action block      # block | monitor
                next
            end
        end
    next
end

The category values are FortiGuard category IDs and match the web-filter category list. I'm deliberately not printing numbers here — set the categories in the GUI, or confirm each ID against the FortiOS FortiGuard category reference before typing one, because a wrong ID blocks the wrong thing.

Optional — a static domain block/allow list

To block or explicitly allow specific domains regardless of category, build a domain filter table and attach it. In the GUI this is the Domain Filter section of the same DNS Filter profile — add entries with type Simple / Wildcard / Regex and action Block / Allow / Monitor. Add one throwaway test domain you control here now; you'll use it to verify in Step 5.

Step 4 — Apply the profile to a firewall policy

Do this on a single test policy first, not your main outbound rule.

GUI

1. Policy & Objects → Firewall Policy, edit the outbound policy.
2. Under Security Profiles, toggle DNS Filter on and select corp-dns-filter.
3. Enabling a security profile requires an SSL Inspection profile — certificate-inspection is the standard choice and is enough for DNS filtering (deep inspection is only needed for DNS-over-HTTPS handling).
4. OK.

CLI

config firewall policy
    edit <policy-id>                          # your outbound policy ID
        set utm-status enable
        set dnsfilter-profile "corp-dns-filter"
        set ssl-ssh-profile "certificate-inspection"
    next
end

Replace <policy-id> with the real ID (show firewall policy lists them).

Step 5 — Verify

Confirm the config is in place:

get system dns
show dnsfilter profile corp-dns-filter
show firewall policy <policy-id>

The last two should show the profile contents and set dnsfilter-profile "corp-dns-filter" on the policy.

Now test from a client behind that policy, not from the FortiGate itself. Query the throwaway domain you added to the static block list:

nslookup blocked.example.com

A blocked lookup is not silently dropped — the FortiGate answers with a redirect to the FortiGuard block portal, so you'll get a response pointing at a portal address rather than the real record. That is the signal it worked.

Then check the logs:

• GUI: Log & Report → DNS Query (or Security Events → DNS Filter). You should see the query with action Block / Redirect and the category or "Botnet"/"Static Domain Filter" reason.

If categories aren't being rated (everything shows as "unrated"), confirm the FortiGuard licence under Dashboard → Status → Licenses.

Undo / rollback

Least invasive first — remove the profile from the policy but leave the profile defined:

config firewall policy
    edit <policy-id>
        unset dnsfilter-profile
    next
end

If this was the only security profile on that policy, you can also unset utm-status. Delete the profile itself only once nothing references it:

config dnsfilter profile
    delete "corp-dns-filter"
end

To revert the resolver change, set primary/secondary back under config system dns (or clear them to return to defaults).

If anything is worse than you expected, restore the backup from Step 1: Dashboard → System → Configuration → Restore, or from CLI execute restore config flash dns-baseline. Note that a full config restore reboots the unit and reverts everything since the backup — which is exactly why you took it before starting, and why this belongs in a maintenance window.

For the authoritative keyword and menu references — especially the DNS-over-TLS settings and the FortiGuard category IDs I intentionally left blank — see the FortiOS 7.4 Administration Guide, sections "DNS Filter" and "DNS over TLS and HTTPS", on the Fortinet Document Library.