How do you implement split DNS (split-horizon DNS) with FortiGate?

How do you implement split DNS (split-horizon DNS) with FortiGate?

• A. Configure a single DNS resolver for all queries.
• B. Use FortiGuard DNS only.
• C. Configure internal DNS resolution for internal domains via internal DNS servers while external queries use external resolvers; apply DNS settings accordingly and enforce via policies.
• D. Disable internal DNS resolution.

Answer: (C)

Split DNS means giving internal clients different DNS answers than external users, so internal domains resolve to internal hosts while external queries use public resolvers. FortiGate can implement this by directing internal domain lookups to your internal DNS servers and letting external queries go to external resolvers, with policies that enforce who uses which path. In practice, you set up internal DNS resolution for the internal zones using your own DNS servers, and on FortiGate configure rules—such as domain overrides or DNS forwarding policies—to forward those internal-domain queries to the internal servers. For anything outside those internal zones, FortiGate forwards to external DNS resolvers. This approach keeps internal names and addresses private while still allowing external users to resolve public names. Other options don’t fit because using a single DNS resolver eliminates the separation between internal and external views; relying solely on FortiGuard DNS provides only external resolution and doesn’t route internal domains to internal servers; and disabling internal DNS resolution removes the ability for internal hosts to resolve internal names at all.

Split DNS means giving internal clients different DNS answers than external users, so internal domains resolve to internal hosts while external queries use public resolvers. FortiGate can implement this by directing internal domain lookups to your internal DNS servers and letting external queries go to external resolvers, with policies that enforce who uses which path. In practice, you set up internal DNS resolution for the internal zones using your own DNS servers, and on FortiGate configure rules—such as domain overrides or DNS forwarding policies—to forward those internal-domain queries to the internal servers. For anything outside those internal zones, FortiGate forwards to external DNS resolvers. This approach keeps internal names and addresses private while still allowing external users to resolve public names.

Other options don’t fit because using a single DNS resolver eliminates the separation between internal and external views; relying solely on FortiGuard DNS provides only external resolution and doesn’t route internal domains to internal servers; and disabling internal DNS resolution removes the ability for internal hosts to resolve internal names at all.