H-Series Feature missing: Automatic PTR (reverse DNS) records for DNS A-Records on USG

hli

Device / Firmware: USG FLEX 100H, firmware 1.40(ABXF.0). Probably affects all USG FLEX H series models running uOS.

Description:
On the legacy ZLD-based firewalls (USG / ZyWALL / USG FLEX non-H), the built-in DNS server had an “Address/PTR Record” table. Creating an entry such as vcenter01.example.local → 192.168.1.20 automatically created the matching PTR record in the background, so the firewall answered both forward and reverse lookups.

On the H series with uOS, the DNS settings only offer “A Records”. Forward lookups work. Reverse lookups for the same IP are not answered locally and get forwarded upstream, where they fail (NXDOMAIN).

Impact:

• Some services require working forward and reverse DNS for local hosts, for example VMware vCenter / ESXi. This is especially critical when the internal DNS servers run as VMs on the same infrastructure. If those VMs are down (e.g. during a cluster restart or an outage), the firewall is the only DNS source left. Without PTR records, vCenter and related services can fail to start or behave unpredictably.
• Logs, monitoring tools (e.g. SNMP/syslog collectors), and network scanners show only IP addresses instead of hostnames (when Firewall is used as DNS-Server).
• Customers migrating from ZLD to uOS lose existing functionality and need an additional internal DNS server or a forwarder workaround just for reverse lookups (stupid!).

Requested feature (any of the following):

1. Automatically create the matching PTR record when an A record is added, as on ZLD. Ideally there is a checkbox, “Create PTR record”, enabled by default.
2. Alternatively, a separate PTR record table in the DNS settings.
3. CLI support for creating PTR records.

Current workaround:
A Domain Zone Forwarder for the x.x.x.in-addr.arpa zone that points to an external or internal DNS server holding the reverse zone. This works, but it is not a proper solution!! It adds complexity and an extra dependency that the previous generation didn’t need. It also defeats the purpose of using the firewall as a fallback DNS: if the target DNS server is unavailable, reverse lookups fail again.

Thank you for considering this as soon as possible.