AAAA (IPv6) DNS requests control

[itinfranetwork]

Hi,

Some devices on our network generate a lot of AAAA DNS requests, despite having their IPv6 stack disabled. This causes an unwanted extra load on our DNS servers, which we'd like to avoid.

Is there a way to specifically drop AAAA DNS queries with a CheckPoint R81.20 gateway ?

Thanks.

[PhoneBoy · Accepted solution]

That would imply there's an explicit rule allowing traffic to the relevant DNS server in the first place.
Or you allow DNS traffic via Global Properties:

In R82, we provide dnsmasq, which might help with this situation.
Note that dnsmasq is also available in earlier releases, but it's not formally supported and must be activated manually.
As far as filtering specific types of DNS requests (i.e. specific lookups) outside of Threat Prevention capabilities, don't believe this is possible.