\n BlueFox Security is a blog about networking, cybersecurity, and IT.\n It shares practical insights, technical guides, and real-world experiences around\n secure infrastructure, modern networks, and everyday IT challenges.\n
\nFortiGate offers strong DNS security capabilities, but that does not automatically make FortiGuard’s own DNS service the best default resolver choice for every new deployment.
When administrators evaluate DNS in a FortiGate environment, two different functions are often mixed together: DNS security enforcement and recursive DNS resolution. FortiGate provides DNS-layer protection through features such as DNS Filter, FortiGuard category-based filtering, botnet C&C domain blocking, static domain filters, safe search enforcement, and external block lists. At the same time, Fortinet also supports secure DNS connectivity over DNS over TLS (DoT) to FortiGuard secure DNS when FortiGuard Anycast is enabled.
The key point is that these are not the same architectural decision. You can absolutely use FortiGate as the policy enforcement and inspection layer without making FortiGuard’s own recursive DNS or secure DNS endpoints your primary resolver. That distinction is important because it allows organizations to keep FortiGate’s DNS security controls while still choosing a different upstream resolver for better resilience, privacy posture, or performance.
Recommendation: For most new deployments, use a third-party recursive DNS provider such as Cloudflare or Quad9, while keeping FortiGate DNS filtering enabled as the local enforcement layer.
Recursive DNS is foundational infrastructure. If the resolver path becomes unstable, users experience failed or delayed name resolution regardless of how strong the firewall policy is. Fortinet’s public DoT status page for FortiGuard secure DNS shows that the service has had recent incidents, including a DNS DoT query outage on May 28, 2026, and the page also shows that some regions had less than 100% uptime over the previous 60 days. That does not mean FortiGuard is unusable, but it does raise a valid operational concern when designing greenfield deployments.
In other words, FortiGuard security intelligence may be valuable, but upstream DNS resolution itself should still be chosen with reliability and operational independence in mind. Treating these as separate design decisions gives you more flexibility and reduces the chance that a FortiGuard Anycast or DoT issue will directly affect core DNS availability.
A stronger design for new deployments is to let a specialized resolver provider handle recursive DNS, while the FortiGate remains responsible for DNS inspection, policy enforcement, and logging. Because FortiGate DNS filtering operates on DNS traffic traversing the firewall or on the FortiGate’s own interface-based DNS service, you do not need to use FortiGuard’s resolver to benefit from FortiGate’s DNS security features.
This hybrid model gives you the best of both worlds: a dedicated upstream DNS service for stability and performance, plus FortiGate-based enforcement for local control and visibility. For most organizations, that is easier to operate, easier to troubleshoot, and easier to justify architecturally.
Cloudflare’s public resolver at 1.1.1.1 is positioned around speed, privacy, and easy deployment. Cloudflare documents support for both DoH and DoT, and it also offers 1.1.1.1 for Families variants that can block malware or malware plus adult content. Cloudflare states that these filtered variants use the same privacy commitments as the standard 1.1.1.1 resolver.
Cloudflare also has one of the strongest public performance stories. DNSPerf’s public resolver rankings currently place Cloudflare at the top of its published performance list, making it a strong candidate for organizations that care about low latency and broad global coverage.
Quad9 is a Swiss-based nonprofit focused on privacy and security. Its main secure resolver at 9.9.9.9 blocks domains associated with malware, phishing, scams, and other malicious activity. Quad9 supports DoT, DoH, and DNSCrypt, and it also provides DNSSEC validation on its secure services.
Quad9’s privacy position is especially attractive for organizations that want their resolver choice to align with a stronger data-minimization approach. Quad9 states that it does not log end-user IP addresses and highlights its Swiss legal jurisdiction as part of its privacy model.
For most new FortiGate deployments, the most balanced architecture is:
FortiGuard DNS is valuable as a DNS security and filtering layer, but third-party DNS should usually be the default recommendation for new deployments.
FortiGate should remain the platform for inspection, logging, and enforcement. Upstream recursive DNS should be provided by a specialized resolver such as Cloudflare or Quad9, depending on whether your priority is performance or security-first privacy.
Last reviewed: June 2026
","content_text":"FORTIGUARD DNS VS. THIRD-PARTY DNSFORTIGUARD DNS VS. THIRD-PARTY DNS: WHY NEW\nDEPLOYMENTS SHOULD LOOK BEYOND FORTIGUARD’S RESOLVER\n\nFortiGate offers strong DNS security capabilities, but that does not\nautomatically make FortiGuard’s own DNS service the best default resolver choice\nfor every new deployment.\n\nWhen administrators evaluate DNS in a FortiGate environment, two different\nfunctions are often mixed together: DNS security enforcement and recursive DNS\nresolution. FortiGate provides DNS-layer protection through features such as DNS\nFilter, FortiGuard category-based filtering, botnet C&C domain blocking, static\ndomain filters, safe search enforcement, and external block lists. At the same\ntime, Fortinet also supports secure DNS connectivity over DNS over TLS (DoT) to\nFortiGuard secure DNS when FortiGuard Anycast is enabled.\n\nThe key point is that these are not the same architectural decision. You can\nabsolutely use FortiGate as the policy enforcement and inspection layer without\nmaking FortiGuard’s own recursive DNS or secure DNS endpoints your primary\nresolver. That distinction is important because it allows organizations to keep\nFortiGate’s DNS security controls while still choosing a different upstream\nresolver for better resilience, privacy posture, or performance.\n\n\n\n\nRecommendation: For most new deployments, use a third-party recursive DNS\nprovider such as Cloudflare or Quad9, while keeping FortiGate DNS filtering\nenabled as the local enforcement layer.\n\n\nWHY THE RESOLVER CHOICE MATTERS\n\nRecursive DNS is foundational infrastructure. If the resolver path becomes\nunstable, users experience failed or delayed name resolution regardless of how\nstrong the firewall policy is. Fortinet’s public DoT status page for FortiGuard\nsecure DNS shows that the service has had recent incidents, including a DNS DoT\nquery outage on May 28, 2026, and the page also shows that some regions had less\nthan 100% uptime over the previous 60 days. That does not mean FortiGuard is\nunusable, but it does raise a valid operational concern when designing\ngreenfield deployments.\n\nIn other words, FortiGuard security intelligence may be valuable, but upstream\nDNS resolution itself should still be chosen with reliability and operational\nindependence in mind. Treating these as separate design decisions gives you more\nflexibility and reduces the chance that a FortiGuard Anycast or DoT issue will\ndirectly affect core DNS availability.\n\n\n\n\n\nFORTIGUARD DNS: STRENGTHS AND WEAKNESSES\n\n\nPROS\n\n * Native integration with FortiGate security policies and security profiles.\n * Support for DNS-layer controls such as FortiGuard category-based filtering,\n botnet C&C domain blocking, static domain filtering, safe search enforcement,\n DNS translation, and external IP block lists.\n * Operational simplicity for Fortinet-centric environments where administrators\n want enforcement and visibility in a single platform.\n * Support for secure DNS over TLS when FortiGuard Anycast is enabled.\n\n\nCONS\n\n * Dependency on FortiGuard Anycast-backed secure DNS availability if used as\n the main upstream resolver path.\n * Recent public incident history on Fortinet’s DoT status page shows that\n outages and regional availability issues do occur.\n * Less flexibility than choosing a dedicated public recursive DNS provider\n whose primary mission is resolver performance, privacy, or threat blocking.\n\n\nWHY THIRD-PARTY DNS IS OFTEN THE BETTER DEFAULT\n\nA stronger design for new deployments is to let a specialized resolver provider\nhandle recursive DNS, while the FortiGate remains responsible for DNS\ninspection, policy enforcement, and logging. Because FortiGate DNS filtering\noperates on DNS traffic traversing the firewall or on the FortiGate’s own\ninterface-based DNS service, you do not need to use FortiGuard’s resolver to\nbenefit from FortiGate’s DNS security features.\n\nThis hybrid model gives you the best of both worlds: a dedicated upstream DNS\nservice for stability and performance, plus FortiGate-based enforcement for\nlocal control and visibility. For most organizations, that is easier to operate,\neasier to troubleshoot, and easier to justify architecturally.\n\n\n\n\n\nCLOUDFLARE: BEST FOR PERFORMANCE AND SIMPLICITY\n\nCloudflare’s public resolver at 1.1.1.1 is positioned around speed, privacy, and\neasy deployment. Cloudflare documents support for both DoH and DoT, and it also\noffers 1.1.1.1 for Families variants that can block malware or malware plus\nadult content. Cloudflare states that these filtered variants use the same\nprivacy commitments as the standard 1.1.1.1 resolver.\n\nCloudflare also has one of the strongest public performance stories. DNSPerf’s\npublic resolver rankings currently place Cloudflare at the top of its published\nperformance list, making it a strong candidate for organizations that care about\nlow latency and broad global coverage.\n\n\n\n\n\nCLOUDFLARE PROS\n\n * Very strong public performance reputation.\n * Simple deployment with clear DoH and DoT support.\n * Optional malware blocking and family-safe filtering variants.\n * Documented privacy commitments backed by independent assessment.\n\n\nCLOUDFLARE CONS\n\n * The default service is primarily a fast, clean recursive resolver rather than\n a security-first resolver by default.\n * If stronger DNS-layer blocking is desired, administrators must deliberately\n choose the filtered variants instead of the standard addresses.\n\n\nQUAD9: BEST FOR SECURITY-FIRST AND PRIVACY-FOCUSED DEPLOYMENTS\n\nQuad9 is a Swiss-based nonprofit focused on privacy and security. Its main\nsecure resolver at 9.9.9.9 blocks domains associated with malware, phishing,\nscams, and other malicious activity. Quad9 supports DoT, DoH, and DNSCrypt, and\nit also provides DNSSEC validation on its secure services.\n\nQuad9’s privacy position is especially attractive for organizations that want\ntheir resolver choice to align with a stronger data-minimization approach. Quad9\nstates that it does not log end-user IP addresses and highlights its Swiss legal\njurisdiction as part of its privacy model.\n\n\n\n\n\nQUAD9 PROS\n\n * Security-first default behavior with malicious-domain blocking built into the\n main service.\n * Strong privacy posture and Swiss nonprofit governance model.\n * Support for DoT, DoH, DNSCrypt, and DNSSEC validation.\n\n\nQUAD9 CONS\n\n * A more opinionated security-first service can occasionally introduce false\n positives or exception-handling overhead.\n * It is generally chosen more for privacy and security than for having the\n strongest public latency benchmark story.\n\n\nRECOMMENDED APPROACH FOR NEW DEPLOYMENTS\n\nFor most new FortiGate deployments, the most balanced architecture is:\n\n\n\n\n * Use Cloudflare if your priority is performance, simplicity, and easy\n encrypted DNS rollout.\n * Use Quad9 if your priority is security-first blocking and stronger privacy\n posture.\n * Keep FortiGate DNS filtering enabled so the firewall remains your enforcement\n and visibility layer.\n * Avoid making FortiGuard secure DNS / DoT the default upstream dependency for\n every deployment unless you have validated the service stability for your\n regions and requirements.\n\n\nFINAL VERDICT\n\nFortiGuard DNS is valuable as a DNS security and filtering layer, but\nthird-party DNS should usually be the default recommendation for new\ndeployments.\n\nFortiGate should remain the platform for inspection, logging, and enforcement.\nUpstream recursive DNS should be provided by a specialized resolver such as\nCloudflare or Quad9, depending on whether your priority is performance or\nsecurity-first privacy.\n\n\nSOURCES\n\n * FortiGuard DNS DoT Status\n * Fortinet Documentation – DNS over TLS\n * Fortinet Documentation – Configuring a DNS Filter Profile\n * Cloudflare 1.1.1.1 Resolver Documentation\n * Quad9 Documentation\n * Quad9 FAQ\n * DNSPerf Public Resolver Performance\n\nLast reviewed: June 2026","image":"https://media-cdn.bluefox-security.ch/bluefox-security-ch/production/images/item-d9b8803cc8af9d0aa66aa0cbc67aec68.png","date_published":"2026-06-15T11:16:41.555Z","_microfeed":{"web_url":"https://bluefox-security-ch.pages.dev/i/fortiguard-dns-vs-third-party-dns-why-new-deploy-rwn7dln_d_V/","json_url":"https://bluefox-security-ch.pages.dev/i/rwn7dln_d_V/json/","rss_url":"https://bluefox-security-ch.pages.dev/i/rwn7dln_d_V/rss/","guid":"rwn7dln_d_V","status":"published","itunes:episodeType":"full","date_published_short":"Mon Jun 15 2026","date_published_ms":1781522201555}}],"_microfeed":{"microfeed_version":"0.1.2","base_url":"https://bluefox-security-ch.pages.dev","categories":[{"name":"Business"},{"name":"Education","categories":[{"name":"How To"}]},{"name":"Technology"}],"subscribe_methods":[{"name":"RSS","type":"rss","url":"https://bluefox-security-ch.pages.dev/rss/","image":"https://bluefox-security-ch.pages.dev/assets/brands/subscribe/rss.png","enabled":true,"editable":false,"id":"Jt50PTobYqy"},{"name":"JSON","type":"json","url":"https://bluefox-security-ch.pages.dev/json/","image":"https://bluefox-security-ch.pages.dev/assets/brands/subscribe/json.png","enabled":true,"editable":false,"id":"0GXyXOWaktE"}],"description_text":"WELCOME TO BLUEFOX SECURITY\n\nBlueFox Security is a blog about networking, cybersecurity, and IT. It shares\npractical insights, technical guides, and real-world experiences around secure\ninfrastructure, modern networks, and everyday IT challenges.","copyright":"©2026","itunes:type":"episodic","items_sort_order":"newest_first"}}