> Source: [sk1000127](https://support.checkpoint.com/results/sk/sk1000127)

# sk1000127 - DNS Packets Are Processed Through the Medium Path Although DNS Inspection Is Disabled

| Property | Value |
|----------|-------|
| Solution ID | sk1000127 |
| Date Created | 2026-09-09 |
| Last Modified | 2026-09-30 |
| Technical Level | General |
| Products | Security Gateway, Check Point Firewall |
| Versions | R82.10, R82, R82.20 |

## Symptoms

- * DNS packets are processed through the Medium Path, although DNS inspection protections are disabled.
* Disabling `fw_dns_verification` in GuiDBedit or through SmartConsole protections does not resolve the issue.

## Cause

In R82 and higher, a DNS streaming parser (`E_CMI_LOADER_PARSER_DNS`) can remain active independently of DNS inspection protections.

The parser is controlled by the global parameter `record_dns_enabled`.

The parameter is disabled by default in R81.20 and enabled by default in R82 and higher.

When the DNS parser is active, DNS packets can be processed through the Medium Path.

## Solution

**On the affected Security Gateway:**
=====================================

1. Disable the DNS parser:

   `fw ctl set int record_dns_enabled 0`
2. Reinstall the local policy:

   `fw fetch local`
3. Verify that DNS traffic is no longer processed through the Medium Path.

**Note-** To set the persistence behavior of `record_dns_enabled` after reboot:  
For R82 and R82.10, see [sk26202](https://support.checkpoint.com/results/sk/sk26202)

For R82.20 and later versions, set the parameter value through the **Gaia WebUI** -\> **System Management** -\> **Advanced Configuration**

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content