DNS Filter Anycast Cloud Timeout Adding 5-Second Latency to LAN DNS Queries
When FortiGate acts as a recursive LAN DNS server or forwarder with DNS Filtering enabled, synchronous Anycast FortiGuard rating lookups inject exactly 5,000ms latency spikes into local workstation queries during WAN jitter.
Technical Root Cause Analysis
The FortiOS dnsproxy daemon is responsible for intercepting DNS traffic on interface listeners or transparent transit policies. When a DNS Filter profile is attached, each new domain query is evaluated against FortiGuard Category databases.
In FortiOS versions 7.2.4 through 7.2.7, DNS Filter enforced synchronous cloud rating by default. If a workstation requested resolution for an uncached domain (e.g. api.github.com), dnsproxy held the inbound UDP client packet in an internal processing queue while dispatching a query to FortiGuard Anycast rating servers (UDP 8888 / HTTPS 443). On branch offices with satellite, cellular, or high-jitter WAN connections, or during regional Anycast BGP route flap, the cloud response failed to return within normal round-trip times. dnsproxy waited until the hardcoded 5,000ms rating-timeout expired before releasing the DNS response to the client, causing perceived web stalls, Active Directory login pauses, and timeout errors across the LAN.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.4 – 7.2.7 | 7.2.8+ | Tune Asynchronous DNS rating |
| FortiOS 7.4 | 7.4.0 – 7.4.2 | 7.4.3+ | Reduce rating-timeout to 1000ms |
| FortiOS 7.0 | 7.0.10 – 7.0.14 | 7.0.15+ | Disable synchronous inspection |
Platform Impact: Branch office and enterprise FortiGate firewalls acting as the primary DNS server / DHCP gateway for local LAN subnets with DNS filtering active.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these commands to inspect dnsproxy worker queue depths, Anycast round-trip latencies, and check memory consumption:
Diagnostic Commands
# 1. Inspect live dnsproxy daemon statistics, queue depth, and drop counts
diagnose test application dnsproxy 1
# 2. Check FortiGuard server rating latency and packet loss
diagnose debug rating
# 3. View memory utilization of the dnsproxy process
diagnose sys top-mem 10 | grep dnsproxy
# 4. Dump dnsproxy DNS filter cache statistics
diagnose test application dnsproxy 2Remediation & Workaround Steps (Teaser Preview)
Eliminate 5-second DNS latency spikes across your corporate LAN immediately:
Frequently Asked Questions
In FortiOS 7.2.4–7.2.7, DNS Filter queries FortiGuard Anycast rating servers synchronously with a default 5-second (5,000ms) timeout. If WAN latency, packet loss, or Anycast server throttling delays the rating reply, dnsproxy holds the client query in memory until the 5-second timer expires before forwarding the cached or upstream DNS answer.
Asynchronous DNS rating enables the FortiGate to immediately answer DNS requests from local cache or forward upstream without blocking the client. Meanwhile, the FortiGuard rating query executes in the background. If a domain is subsequently determined to be malicious, subsequent requests are blocked.
Only if the FortiGate acts as the default DNS forwarder/server for LAN interfaces, or if a DNS Filter profile is applied to the firewall transit policy inspecting port 53 UDP/TCP traffic.