> Source: [sk31727](https://support.checkpoint.com/results/sk/sk31727)

# sk31727 - Traffic is dropped by SmartDefense / IPS with "DNS Attack Info: Unauthorized domain request" log

| Property | Value |
|----------|-------|
| Solution ID | sk31727 |
| Date Created | 2006-04-27 |
| Last Modified | 2019-12-25 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- Traffic is dropped by SmartDefense / IPS with these logs in SmartView Tracker:

* `DNS Attack Info: Unauthorized domain request`
* `DNS Attack Info: Invalid DNS`

## Cause

An organizational name server may be subject to queries regarding zones that are not associated with the organization's domain. If this type of request is enabled, the DNS server resources will be wasted on Internet queries that have nothing to do with the organizations network.   

The SmartDefense / IPS protection can prevent unauthorized inbound queries whose content is not a part of the name servers' predefined zone. SmartDefense / IPS enables the creation of a list of DNS servers, for which inbound requests for external domain information are rejected.   

The "Unauthorized domain request" message is generated if the protection is enabled, the DNS server is defined in the DNS servers list, and the request for an outside domain came through an external interface.

## Solution

This error message may indicate malicious attempt to consume network resources. It may also result from a wrongful configuration of the topology and/or DNS servers.   

A wrong configuration might be caused by one of the following:

1. Incorrect topology on the Security Gateway:

   The protection inspects the packets coming on the External interface side. If an internal interface is configured as external, there's a possibility that this protection will be triggered on legitimate DNS traffic.   

2. Insufficient configuration of the internal DNS servers:

   The SmartDefense / IPS protection inspects incoming DNS requests to internal DNS servers. It only inspects traffic to servers that have the Drop Inbound requests protection enabled. It matches these requests against the domains list of the DNS server. Every domain that is intended to be accessed from the Internet needs to be added to the Authorization Domains list of the relevant DNS server. The Authorization Domains list can be found on the Node properties of each DNS server.
   * In SmartDashboard:

     1. Go to *IPS* tab - click on *Protections*
     2. In "*Look for* " field, enter "*Inbound DNS Requests*"
     3. Right-click on the "*Inbound DNS Requests* " protection - click on "*Details...* " - select the relevant IPS profile - click on "*Edit...*" button
     4. Select "*Override IPS Policy with:* " - select either "*Inactive* " or "*Detect*"
     5. Click *OK* in all windows to apply the changes
     6. Install security policy

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content