DNS Filter Daemon 'dnsproxy' 100% CPU Spike during PTR Query Bursts
The FortiOS DNS proxy service dnsproxy spikes to 100% CPU utilization across all processor cores due to internal cache spinlock contention when networks encounter bursts of reverse DNS (in-addr.arpa PTR) queries from vulnerability scanners or SIEM tools.
Technical Root Cause Analysis
The FortiOS dnsproxy daemon handles local DNS server features, DNS inspection profiles, and FortiGuard DNS filtering. To accelerate recurring lookups, the process maintains an in-memory hash table caching both forward (A/AAAA) and reverse (PTR) records.
In affected FortiOS 7.2 builds, the internal hash table implementation relies on a single coarse-grained spinlock protecting both read lookups and write insertions. When automated enterprise systems—such as Nessus vulnerability scans, Active Directory domain controllers, or SIEM log enrichers—transmit high-rate bursts of reverse DNS PTR lookups, multiple dnsproxy worker threads attempt to acquire the lock simultaneously. The threads enter intense spinlock polling loops, driving core CPU consumption to 99–100%. While CPU is pinned, incoming client DNS queries are dropped or time out, resulting in widespread web browsing failures and Active Directory service disruptions across the enterprise.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.3 – 7.2.6 | 7.2.7+ | Flush cache via CLI and bypass reverse PTR filter |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Striped bucket locks implemented in 7.4.2 |
| FortiOS 7.0 | Not Affected | 7.0.x Branch Clean | Legacy single-threaded dnsproxy architecture did not lock |
Platform Impact: Affects all FortiGate models (FG-60F up through FG-600F) running DNS Filter profiles or acting as a local DNS forwarding server in networks subjected to automated scanning or heavy SIEM reverse lookups.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands to verify whether dnsproxy is pinned at 100% CPU and inspect current cache table locks:
Diagnostic Commands
# 1. Inspect dnsproxy process CPU utilization over 5 iterations
diagnose sys top 2 5 | grep dnsproxy
# 2. Query dnsproxy internal cache statistics and memory usage
diagnose test application dnsproxy 1
# 3. View internal thread lock contention counters and queue depth
diagnose test application dnsproxy 7
# 4. Filter incoming DNS query traffic to identify PTR query flooding sources
diagnose sniffer packet any "port 53 and udp[10] & 0x80 = 0" 4 0 lRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the interactive Ferrite platform:
Frequently Asked Questions
In affected FortiOS releases, the dnsproxy daemon protects its internal in-memory DNS record cache with a coarse global spinlock. When automated systems (such as vulnerability scanners, SIEM log enrichers, or active directory controllers) emit high-concurrency bursts of reverse PTR lookups, all worker threads contend for the same lock simultaneously, causing spinlock thrashing and driving CPU utilization to 100%.
Executing 'diagnose test application dnsproxy 2' purges the internal DNS hash table, releasing all contending locks and instantly restoring normal CPU levels without interrupting established network traffic.
Permanent resolution is included in FortiOS 7.2.7 and 7.4.2+, where dnsproxy's internal cache was re-engineered with striped bucket locks and lock-free Read-Copy-Update (RCU) lookups.