FQDN object is broken, does not return IPs most of the times.

bbp

Objects→Address→FQDN is querying IN ANY instead of being more specific like A, AAAA, etc.

Many DNS providers do not respond to ANY queries, or only return a subset of records, because of their misuse in DNS amplification DDoS attacks, hence results are broken.

Example of truncated result:

Trying "dns.cloudflare.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52418
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;dns.cloudflare.com. IN ANY

;; ANSWER SECTION:
dns.cloudflare.com. 2019 IN HINFO "RFC8482" ""

Received 57 bytes from 127.0.0.1#53 in 0 ms

Due to truncated results, FQDN object type is not usable in Security Policy→Policy Control rules.

Please fix it.

Zyxel_Melen

Hi @bbp

We received the same request, and this will be enhanced in the future firmware release.

Zyxel_Melen

Hi @bbp

We received the same request, and this will be enhanced in the future firmware release.

bbp

https://community.zyxel.com/en/discussion/comment/83450#Comment_83450

That's good to hear, thank you Melen.