Solved

Is my Windows 2003 DNS server sending notifications? Can I force it to?

Posted on 2009-05-11
9
678 Views
Last Modified: 2012-05-06
I've been trying to move my zones from a BIND server to a Windows DNS server with embarrassing results. For a couple of zones, Windows rejected some of the old, illegal entries and broke.

Anyway, today's FIRST issue is this: my server doesn't seem to be sending out notifications. I transferred the primary role for the zone from one (BIND) box to a windows box. I accidentally left the port blocked so the initial transfer to the (main campus) DNS server couldn't happen. I fixed that right away, but it hasn't initiated a transfer since then (at least 8 hours).
I've changed records and reloaded the zone, hoping to initiate a notify and thus a transfer, but no dice.
I'm allowing transfers to everyone (I know, I'll lock it back down when this gets fixed);
The other server is listed as a DNS server for the zone;
I have tried setting my server to notify other DNS servers;  then put in the specific IP address;
Neither helped.

Should I be able to see notifications in the Windows Event Log? It shows transfers but I don't see notifications.
Is there anything I can do (other than changing entries in the zone) to force it to send notifications?

0
Comment
Question by:briandunkle
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 2
9 Comments
 
LVL 71

Expert Comment

by:Chris Dent
ID: 24359455

I don't think notifications are logged. You could increment the serial in the SOA. Does the Unix system have any data for the zone? Would be worth checking what it thinks the SOA and NS are.

Chris
0
 
LVL 7

Author Comment

by:briandunkle
ID: 24359543
Sorry; there are really three servers in this situation - the old, BIND server; the current, Windows server; and the main campus server, which is also BIND.

The communication I need is between the new Windows server and the main campus server.

And yes, things worked fine on the previous server on my end.

Anyway: SOA is the Windows server (DNS2), NS are my server and the main campus one - same setup as my old BIND box (DNS).

I just incremented the serial, worth a try but no dice yet.
I can't imagine the main campus server gave up when it couldn't get through for a while.

My Windows box is getting out there as the primary server for that zone - lookups work from the outside world and, after a slight delay, the local caching nameservers. It's just the primary main campus one that doesn't work.

Outside DNS makes its way to the main campus server and gets SERVFAIL twice then goes to mine.

(the point to all this is that the main campus server is supposed to answer most outside traffic and just generally act as a secondary)
0
 
LVL 7

Author Comment

by:briandunkle
ID: 24359553
Oh, and thanks for the comment!
It bites that it doesn't log notifications.
Windows DNS service seems to fall short of BIND in many ways.
Maybe a 3rd-party Windows-based DNS server? :(
0
Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

 
LVL 15

Expert Comment

by:markpalinux
ID: 24360340

MS Technote:
Using NSlookup.exe
http://support.microsoft.com/kb/200525
look for the section - Using Nslookup.exe to Transfer Entire Zone


I would suggest from the main campus dns server running nslookup -d domain.com

run on bind server at main campus:
nslookup
server ms-dns-server-ip
ls -d domain.com

( use your ms dns server for - ms-dns-server-ip ,
and replace domain.com with the real domain.

Also on the zone in your MS DNS be sure that you have the correct ip for notify and to allow transfer.
also firewalls in between need to allow port 53 tcp and udp.

udp is for standard dns, tcp for zone tranfers

you could try wireshark looking at port 53, increment the zone , look at the traffic to your campus dns up - to see if the notifications are going ?

Also you there is bind you can download for windows (I only ever used it for testing)

Mark
0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 24362676

You could enable Debug Logging, it's packet logging. Although to capture specifics you're far better off using a packet sniffer, Wireshark (http://www.wireshark.org) for example.

Given a choice I would always use BIND for hosting public DNS services. I'll quite happily use MS DNS for AD Domains. It misses out on a lot of functionality when compared with BIND for public hosting.

> SOA is the Windows server (DNS2)

That's in the Secondary Zone at the moment? Might have to look at the zone file to see those.

Chris
0
 
LVL 7

Author Comment

by:briandunkle
ID: 24366444
@markpalinux - I don't have access to the main campus server; I've entered a ticket to ask what's going on with the notifies/transfers, but I'm trying to look into it from my end;

@chris-dent - Yeah, I'm realizing how much Windows DNS sucks. I'm trying to move to a Windows box because all the people except one who might back me up if I'm not here are windows-only (they could do a linux box, but it'd be a pain). I need to move it one way or another, the current box for the rest of my DNS is old and in another building (different vlan). I'd just re-number it, but it's a really old redhat and the machine makes me nervous.

I'll try the debug and see if it gives me anything, thanks.

DNS2 is actually the primary now. "DNS" is the old server, which still serves the other 140+ zones, but may be used as a secondary once everything's moved.

Thanks to both of you for replying!
0
 
LVL 7

Author Comment

by:briandunkle
ID: 24388582
Thanks for the tip on debug logging - it gives a better log than I expected, including every notify and response.
0
 
LVL 7

Author Closing Comment

by:briandunkle
ID: 31580324
What I needed to know to get going on it.
0
 
LVL 7

Author Comment

by:briandunkle
ID: 24388803
To clarify for anyone reading this later, the debug logging is a more sophisticated log than I expected - it shows only the DNS-related packets, and annotates them with a handy key at the top.
Stuff like what it is (notify, query), whether it's a response or an origination, and the result. I got this:
20090514 12:15:43 E7C PACKET  01E9A970 UDP Rcv xxx.xxx.xxx.xxx   0000 R N [05a0       REFUSED] SOA   (8)xxx(7)xxx(3)edu(0)
Saying xxx.xxx.xxx.xxx sent a response  to my notify, refusing it.
Now to figure out why. :)

Thanks again.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
I wrote this article to explain some important DNS concepts that should be known to avoid some typical configuration errors I often see in forums. I assume that what is described here is the typical behavior of Microsoft DNS client. I don't know …
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…

729 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question