I'm trying to figure out a way to have our Fortigate 60C redirect certain subdomains but not block complete access to the domain.

E.G. I want to block update.microsoft.com but I don't want microsoft.com or office.microsoft.com to be blocked.

My current settings are blocking the complete domain. I do find this strange though as I specified a hostname.

config system dns-database 

edit "test" 

config dns-entry 

edit 2 

set hostname "update" 

set ip 



set domain "microsoft.com"

My goals is to prevent certain software from accessing certain urls to prevent devices from downloading updates or phoning home. is set as a loopback.

Blocking access on devices itself is not an option.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin
    Commented Feb 2, 2019 at 2:13

1 Answer 1


I believe you would want to use a "DNS Filter" for this. It has an option to block domains via a "Static Domain Filter". In it, you can specify any combination of subdomains, which will be easier to manage than the dns-database option. Then, you can apply the DNS Filter to any relevant IPv4 Policy objects which should block access to those respective domains.

For example (shown from OS 5.6):

config dnsfilter domain-filter
    edit 0
        set name "block-updates"
        config entries
            edit 1
                set domain "updates.microsoft.com"
                set action block

Note what ID number is created from the above block, and use it as <id> in the block below. (And note that tab expansion will also work.)

config dnsfilter profile
    edit "Block Updates"
        config domain-filter
            set domain-filter-table <id>

It's a bit easier to configure in the GUI, as there's no back and forth between the domain list and the profile.

Then enable it on one or more policies:

config firewall policy
    edit <id>
        set utm-status enable
        set dnsfilter-profile "Block Updates"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.