Enterprise Firewalls

How to Change DNS on Fortinet FortiGate

By [FILL IN], [FILL IN] · Last updated 2026-10-03

FortiGate can use FirewallDNS for its own lookups and hand it to clients through DHCP or the built-in DNS proxy.

Before you start

You need a FirewallDNS account (see pricing). Sign in to your dashboard, register your public IP address and copy your DNS server addresses. Replace <FIREWALLDNS-PRIMARY> and <FIREWALLDNS-SECONDARY> below with them.

Step by step

Go to Network > DNS.
Choose "Specify", enter <FIREWALLDNS-PRIMARY> as Primary and <FIREWALLDNS-SECONDARY> as Secondary. Apply.
Go to Network > Interfaces, edit the LAN interface, and under DHCP Server set DNS server to "Same as System DNS".
Optional: in Network > DNS Servers, add the LAN interface in Recursive mode so the FortiGate acts as DNS proxy.
Create a policy that blocks outbound DNS (port 53) from LAN to anything except the FortiGate to prevent bypass.

FortiOS CLI

config system dns
  set primary <FIREWALLDNS-PRIMARY>
  set secondary <FIREWALLDNS-SECONDARY>
  set protocol cleartext
end
config system dhcp server
  edit 1
    set dns-service default
  next
end

Verify it works

Renew DHCP on a client (Windows: ipconfig /renew, macOS: reconnect Wi-Fi).
Run nslookup example.com and check which server answered.
Open the live log in your dashboard. New lookups should appear within seconds.

Learn more

Not protected yet?

FirewallDNS costs $2.90 per device per month.