When configured as a DNS proxy, the firewall is an intermediary
between DNS clients and servers; it acts as a DNS server itself
by resolving queries from its DNS proxy cache. If it doesn’t find
the domain name in its DNS proxy cache, the firewall searches for
a match to the domain name among the entries in the specific DNS proxy
object (on the interface on which the DNS query arrived). The firewall forwards
the query to the appropriate DNS server based on the match results.
If no match is found, the firewall uses default DNS servers.
A DNS proxy object is where you configure the settings that determine
how the firewall functions as a DNS proxy. You can assign a DNS
proxy object to a single virtual system or it can be shared among
all virtual systems.
If the DNS proxy object is for a virtual system, you
can specify a DNS Server Profile,
which specifies the primary and secondary DNS server addresses,
along with other information. The DNS server profile simplifies
If the DNS proxy object is shared, you must specify at least
the primary address of a DNS server.
configuring multiple tenants (ISP subscribers) with DNS services,
each tenant should have its own DNS proxy defined, which keeps the tenant’s
DNS service separate from other tenants’ services.
In the proxy object, you specify the interfaces for which the
firewall is acting as DNS proxy. The DNS proxy for the interface
does not use the service route; responses to the DNS requests are
always sent to the interface assigned to the virtual router where
the DNS request arrived.
When you Configure a DNS Proxy Object,
you can supply the DNS proxy with static FQDN-to-address mappings.
You can also create DNS proxy rules that control to which DNS server
the domain name queries (that match the proxy rules) are directed.
You can configure a maximum of 256 DNS proxy objects on a firewall.
When the firewall receives an FQDN query (and the domain name
is not in the DNS proxy cache), the firewall compares the domain
name from the FQDN query to the domain names in DNS Proxy rules
of the DNS Proxy object. If you specify multiple domain names in
a single DNS Proxy rule, a query that matches any one of the domain
names in the rule means the query matches the rule. DNS Proxy Rule and FQDN Matching describes
how the firewall determines whether an FQDN matches a domain name in
a DNS proxy rule. A DNS query that matches a rule is sent to the
primary DNS server configured for the proxy object to be resolved.