To resolve internal hostnames using internal DNS servers for remote endpoints in FortiSASE, you need to configure Split DNS rules to direct specific domain queries to internal DNS servers instead of public ones. Additionally, Split tunnelling destinations must be configured to ensure that DNS traffic for internal domains is routed through the SASE tunnel to reach the internal DNS servers. These two components work together to enable proper internal hostname resolution while maintaining security and connectivity for remote users.

A. SSL deep inspection: This is for inspecting encrypted traffic, not for DNS resolution routing.

D. DNS filter: This is for blocking/allowing domains, not for directing queries to specific DNS servers.

1. Fortinet FortiSASE 23.4 Administration Guide, "Split DNS Configuration" section, pages 187-192

2. Fortinet NSE7 Cloud Security 7.0 Study Guide, Chapter 8 "DNS and Split Tunneling", pages 245-248

3. FortiSASE Cloud Security Reference Architecture, Document ID: SASE-RA-23.4, "DNS Resolution for Remote Users" section 4.3

4. Fortinet Technical Documentation Portal, "FortiSASE Split Tunneling Best Practices", Document #FD-54329, pages 12-15

5. FortiSASE Deployment Guide v23.4, "Configuring Split DNS and Tunneling", pages 78-82