> Source: [sk1000077](https://support.checkpoint.com/results/sk/sk1000077)

# sk1000077 - Clients Cannot Resolve Internal Website When Gaia Security Gateway Is Configured as DNS Server

| Property | Value |
|----------|-------|
| Solution ID | sk1000077 |
| Date Created | 2026-08-27 |
| Last Modified | 2026-09-01 |
| Technical Level | General |
| Products | Check Point Firewall |
| OS | Gaia |

## Symptoms

- * Users at one location cannot access an internal website, while users at other locations can access it.
* The browser on the affected client shows this error when the user opens the internal website:

```text
DNS_PROBE_FINISHED_NXDOMAIN
```

* The affected client receives the Check Point Security Gateway Internet Protocol (IP) address as a Domain Name System (DNS) server through Dynamic Host Configuration Protocol (DHCP).
* `nslookup` from the affected client to the Security Gateway IP address fails or times out.

```text
C:\> nslookup app.example.local 172.20.21.1
DNS request timed out.
timeout was 2 seconds.
*** Request to 172.20.21.1 timed-out
```

* A host entry for the internal website exists on the Gaia Security Gateway.
* No equivalent DNS record or local hosts file entry exists on the affected client.
* The website becomes reachable when a local hosts file entry is manually added on the client.
* Security Gateway logs show accepted Hypertext Transfer Protocol Secure (HTTPS) over Transmission Control Protocol (TCP) port 443 and Internet Control Message Protocol (ICMP) traffic from the client to the website IP address.
* Traceroute from the affected client reaches the destination IP address successfully.
* The Security Gateway can resolve the internal website name locally and can ping the destination IP address, but client machines cannot use that local resolution.

## Cause

The affected client was configured to use the Check Point Gaia Security Gateway as a DNS server.

The Gaia **Hosts** feature provides local hostname resolution for the Gaia operating system and Check Point services. It works similarly to entries in the local `/etc/hosts` file. These entries apply only to the local Security Gateway or Management Server.

Gaia host entries are not published to client machines. They are also not synchronized to an external DNS service and are not served as DNS replies to network hosts.

As a result, when the affected client queried the Security Gateway IP address for DNS resolution, the query failed or timed out. Public DNS servers also could not resolve the internal-only hostname.

Traffic logs and traceroute confirmed that firewall policy and routing were working correctly. The issue occurred because client-side DNS resolution was not configured with a valid DNS server that contained the internal website record.

## Solution

1. **Configure a valid internal DNS record:**
   * On the organization's internal DNS server, create or verify a DNS record for the internal website.
   * Example:

```text
app.example.local    A    10.5.67.21
```

* Make sure the DNS record points to the correct internal website IP address.

1. **Update DHCP DNS settings for affected clients:**
   * Configure the DHCP scope for the affected network to provide a valid internal DNS server.
   * Do not configure the Gaia Security Gateway IP address as the client DNS server unless a supported DNS service exists outside the gateway and is reachable by the client.
   * Example DHCP DNS server assignment:

```text
Primary DNS server:   10.10.10.10
Secondary DNS server: 10.10.10.11
```

1. **Renew DNS settings on the affected client:**
   * On the affected client, renew the DHCP lease or restart the network adapter.
   * On a Windows client, run these commands from Command Prompt:

```text
ipconfig /release
ipconfig /renew
ipconfig /flushdns
```

1. **Verify DNS resolution from the affected client:**
   * Run `nslookup` from the client against the internal DNS server.

```text
nslookup app.example.local 10.10.10.10
```

* Expected result:

```text
Name:    app.example.local
Address: 10.5.67.21
```

1. **Verify access to the internal website:**
   * Open the website from the affected client.
   * Confirm that the browser no longer shows:

```text
DNS_PROBE_FINISHED_NXDOMAIN
```

* Confirm that the Security Gateway logs show accepted traffic from the client to the website IP address.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content