> Source: [sk123495](https://support.checkpoint.com/results/sk/sk123495)

# sk123495 - DNS resolve does not work with Malware DNS Trap enabled

| Property | Value |
|----------|-------|
| Solution ID | sk123495 |
| Date Created | 2018-03-14 |
| Last Modified | 2021-08-23 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * After accessing phishing site, DNS queries are not allowed to pass to the external DNS when Malware DNS Trap is enabled.  

* Kernel debug ('`fw ctl debug + domain packet conn vm tcpstr drop spii malware cmi aspii`') shows that after DNS trap the connection is marked with rejection flag (0xc25):  

  `
  ; DATE TIME...;dns_cmi_perform_inject: about to call psl_set_server_injection() with len = 64;`  
  `
  ; DATE TIME...;psl_set_server_injection_ex: entering streamh;`  
  `
  ; DATE TIME...;psl_set_server_injection_ex: setting injection to connection <dir 1, IP address:57020 -> IP address IPP 17>;`  
  `
  ; DATE TIME...;psl_set_reject_conn: added reject dirs 1 to astream=ffffc20059d2e1f0 (flags 0x44802/0xc25/0x405);
  `

## Cause

After DNS trap happens false (bogus) IP injected into the DNS query response then the connection is marked with rejection flag, which causes valid DNS queries being dropped from the same client \& source port based on the connection stored in the connections table.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.   
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.   
For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.

The hotfix adds new kernel parameter that needs to be set in order to solve the issue.

Procedure:

To check the current value of a kernel parameter:

*\[Expert@HostName\]# fw ctl get int psl_udp_drop_packet_allow_connection*

To enable the kernel parameter:

*\[Expert@HostName\]# fw ctl set int psl_udp_drop_packet_allow_connection 1*

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content