> Source: [sk181215](https://support.checkpoint.com/results/sk/sk181215)

# sk181215 - FQDN domain object cannot be matched 

| Property | Value |
|----------|-------|
| Solution ID | sk181215 |
| Date Created | 2023-07-24 |
| Last Modified | 2023-07-24 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * In some scenarios, the traffic sent to the FQDN domain object is not matched by the specific rule in the rulebase.

* The issue can happen several times each day on the specific FQDN domain object, and the access IP address is not cached by the Security Gateway if we check it via [domains_tool](https://support.checkpoint.com/results/sk/sk161632).   
  `# domains_tool -d www.example.com`

## Cause

The service provided by the FQDN domain object utilizes CDN services to deliver content worldwide effectively. For DNS resolution, the DNS server only returns 1 IP for the A record of the FQDN, and the resolved IP address might differ for each DNS query. Check Point Security Gateway will resolve the FQDN against the DNS servers configured every 60 seconds, we will cache the new IP address resolved and update the TTL if the IP is already cached before. The default TTL of the domain cache is 1 hour.  

If the cached IP is not hit again during the DNS query performed by the Security Gateway in 1 hour, it will be removed from the kernel table \[*dns_reverse_cache_tbl*\]. The FQDN domain object match issue will happen if the client tries to access the IP not associated with the FQDN domain object in our Security Gateway.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content