WPAD host record and cname records not answering

Thanks for the advise, Chris. But this is getting more interesting:

As explained, I created an alias, CNAME record on my DNS, named "wpad" and pointing to the FQDN of my internal IIS server. In the exact same way as another alias I already have named "windowsupdate" pointing to the same server.

#############################################################
C:\>ping wpad
Ping request could not find host wpad. Please check the name and try again.

C:\>nslookup wpad <DNSServer1>
Server:  <DNSServer1>.domain.net
Address:  <IPofDNSServer1>

*** <DNSServer1>.domain.net can't find wpad: Non-existent domain

C:\>nslookup wpad <DNSServer2>
Server:  <DNSServer2>.domain.net
Address:  <IPofDNSServer2>

*** <DNSServer2>.domain.net can't find wpad: Non-existent domain

C:\>nslookup wpad <DNSServer3>
Server:  <DNSServer3>.domain.net
Address:  <IPofDNSServer3>

*** <DNSServer3>.domain.net can't find wpad: Non-existent domain

C:\>nslookup wpad <DNSServer4>
Server:  <DNSServer4>.domain.net
Address:  <IPofDNSServer4>

*** <DNSServer4>.domain.net can't find wpad: Non-existent domain

################################################


BUT if I do the same using another alias already existing that points to the SAME server, I get this:


###############################################

C:\>nslookup windowsupdate <DNSServer4>
Server:  <DNSServer4>.domain.net
Address:  <IPofDNSServer4>

Name:    <TargerServerName>.domain.net
Address:  <IPofTargetServer>
Aliases:  windowsupdate.domain.net

########################################################

At this point I am not sure if I am missing something really basic or if I should be worried about some wrong DNS behavior...

Any clue?? Thanks in advance.

I just got this from MS:

"This error occurs when there is no PTR record for the name server's IP address. When Nslookup.exe starts, it does a reverse lookup to get the name of the default server. If no PTR data exists, this error message is returned. To correct make sure that a reverse lookup zone exists and contains PTR records for the name servers."

Checked the PTR records, and there IS a PTR record for the target server which the CNAME record is pointing to.....

Any help is appreciated. Thanks again.

BTW, there obviously are PTR records also for all the DNS servers in the Reverse Zone ....

> nslookup wpad <DNSServer1>

Odd, can you try by FQDN? e.g.

nslookup wpad.domain.net <DNSServer1>

I assume the WPAD entry is in the same zone? And that the client has a DNS Suffix for the domain it's expected to search?

> I just got this from MS:

Out of context, that refers to instances where you get this:

C:\>nslookup windowsupdate <DNSServer4>
Server:  UnKnown
Address:  <IPofDNSServer4>

And an error message. It's trying to populate the Server label and failing. That isn't a problem here, it's past that bit.

Chris

Thanks again, Chris.

C:\>nslookup wpad.domain.net <DNSServer1>
Server:  <DNSServer1>.domain.net
Address:  <IPOfDNSServer1>

*** <DNSServer1>.domain.net can't find wpad.domain.net: Non-existent domain

????

There has to be something wrong with the record.

Any change you can post a screen shot of it?

There aren't any other CNAME records for wpad are there? Unlikely but...

Chris

Hi Chris, the screen shot of the CNAME record is an option, but after hiding all the sensitive info, there is nothing really to check... I can tell you it has the same settings that the other CNAME pointing to the same server, and I actually selected the target server using the Browse option during the CNAME record creation....
There is no other wpad registry in the DNS server at all.
I am running out of ideas....
What would you like to check on the record itself?

I think I have found something here, from the DNS event viewer:

####################################

The global query block list is a feature that prevents attacks on your network by  blocking DNS queries for specific host names. This feature has caused the DNS server to fail a query with error code NAME ERROR for wpad.noam.heiway.net. even though data for  this DNS name exists in the DNS database. Other queries in all locally  authoritative zones for other names that begin with labels in the block list  will also fail, but no event will be logged when further queries are blocked until the DNS server service on this computer is restarted. See product documentation for information about this feature and instructions on how to configure it.
 
Below is the current global query block list  (this list may be truncated in this event if it is too long):
wpad
isatap.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

########################################################

So at least I know the reason behind this weird issue, but the questions now are:

- I think what I am trying to do is something pretty usual, and actually it is well-known way to get the Proxy settings deployed to my clients.... Am I the only one experiencing this issue? or did I miss some extra step to solve this "by default" setting?
- Is there any known workaround for this?

Thanks again in advance.

> Am I the only one experiencing this issue?

No, I don't think you will be.

I used WPAD in my last company and use it in my current without any configuration beyond adding the record and ticking the "automatic configuration" box in IE / Firefox.

But there's this, which is clearly responsible for the failure...

> The global query block list

I've not heard of this before, but my DNS servers are 2003 rather than 2008. This one is quoted as being a feature of 2008. Is that the case here?

Documentation for it is here:

http://technet.microsoft.com/en-us/library/cc794902.aspx

It looks like you can enable it, disable it, view the list and add. To remove items from the list it appears you would have to flush it entirely then re-add any entries you wanted to preserve (just isatap. perhaps).

It's all configurable with DNSCMD at least so should be up easy enough to modify :) Want the commands?

Chris

My DNS servers are for sure Windows 2003.
BUT what I am not that sure, is if the parent domain (this company domain is a child domain from a parent international bigger one) has deployed some Windows 2008 DNS servers out there that are creating these issues.
I will check this out and will definitely update here.
Thanks for the info, Chris.

Do your network clients use only your own DNS servers? It's odd that it's logging that event in the logs on the 2003 servers if the feature isn't available.

Chris

Well, our domain DNS servers have configured some DNS forwarders: two internal DNS servers from the parent domain that are used when trying to solve any IP internal to the enterprise network IP ranges, and also two external DNS servers from the ISP provider that are used when trying to solve any Internet name, (since there was no Proxy in place).

After the deployment of the Proxy settings to everyone (what I am actually trying to do), these external DNS forwarders servers could be removed.

Any idea about where this could come from??

Well it can't hurt to have a look and see what the DNS server thinks about the block list.

Perhaps run:

dnscmd <ServerName> /info /globalqueryblocklist

At worst it'll say "eh?".

Chris

Different way of saying "eh?":

C:\>dnscmd <DNSServer1> /info /globalqueryblocklist
Info query failed
    status = 9553 (0x00002551)

Command failed:  DNS_ERROR_INVALID_PROPERTY     9553  (00002551)

Figures ;)

It's odd that it managed to log the error into the event log on that server if it can't control the feature.

It's definitely not 2008? :)

It has registry entries associated with it, they're here:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\GlobalQueryBlockList

Would be worth having a quick look for those.

Chris

It is definitely not a Windows 8 server ;-) it is a Windows 2003 server.

BUT it DOES have that registry key, REG_MULTI_SZ, with the two strings in there: wpad isatap

At this point, it looks like these values were always there, and this has nothing to do with Windows 8...

May this be a Global Policy being pushed from the parent domain to our DNS servers?? I will check that.

The remaining questions I guess are:

a) If I remove the wpad string, would then work? (easy to check)
b) If I remove the wpad string, would the GPOs put it back during the next GPO update? (also easy to check)

Actually I am going to check it right now.... will update soon.

Thanks again, Chris.

a) Yes, you're likely to need to restart the DNS Service.
b) I wouldn't be surprised.

Perhaps run "rsop.msc" and see if a policy is pushing that onto your machine?

Chris

I can not see any policy being pushed, but not completely sure though.
Have you ever heard of this feature and the corresponding registry key being configured on Windows 2003 DNS servers?

I just removed the wpad from all my DNS servers registry entries and restarted the DNS Server services on those servers. The ping is working perfectly from all the DNS servers and from my own client.

I am going to wait to see if the changes are pushed back by any GPO, but for now, I will move forward with my tests about the Proxy Auto Configuration settings.

> Have you ever heard of this feature and the corresponding registry key
> being configured on Windows 2003 DNS servers?

No, but I'm going to try it tomorrow and see if it can be enabled this way. I only have 2008 on my server here (at home).

Chris

If you get a moment, could you grab the version number from %SystemRoot%\System32\DNS.exe?

Haven't been able to reproduce this on 2003 so far, seeing if I can find a newer version of DNS.exe.

Chris

Well there we go.

It looks like Windows 2003 has that feature (although not documented) if you happen to be running version "5.2.3790.4460" of dns.exe. The previous version, released last year doesn't have it.

Chris

Bingo.

I just checked. It is exactly that one: 5.2.3790.4460

How is it possible this features are not documented? I guess this has some significant impact, since what I am trying to do it is not that exceptional, right?

Hey Chris, I will move on to the next step (basically make my proxy script work...), but I would say this question has been fully solved. Thanks for your help!

No worries, good luck with the script :)

Chris

Thanks Chris.