Malware dns trap exception for locally-hosted public nameservers?

[Chris4Checkmate]

Hi,

in my knowledge the feature <Malware DNS Trap> returns a bogus ip in the dns reply packet if the requested fqdn is listed as infected. This is a great feature for protecting local customers/clients.

But we are also hosting a public nameserver (behind) the same Checkpoint firewall instance. We do not want that the dns-replies of our locally-hosted public nameserver are also manipulated for the whole internet.
In my opinion the decision which fqdn is bad should be done by each individual customer and not by any public name server for the whole internet.

Is there any possibility to disable the <Malware DNS Trap> feature for specific target-addresses (like our public nameserver)? Or is there any other solution beside disabling this feature completely (or installing separate firewalls)?

Regards,
Chris

[PhoneBoy · Accepted solution]

This feature is designed to protect internal DNS servers.
However, you can effectively "disable" this by using the fast_accel feature for DNS traffic to this specific host: https://support.checkpoint.com/results/sk/sk156672