Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


Is my Windows 2003 DNS server sending notifications? Can I force it to?

Posted on 2009-05-11
Medium Priority
Last Modified: 2012-05-06
I've been trying to move my zones from a BIND server to a Windows DNS server with embarrassing results. For a couple of zones, Windows rejected some of the old, illegal entries and broke.

Anyway, today's FIRST issue is this: my server doesn't seem to be sending out notifications. I transferred the primary role for the zone from one (BIND) box to a windows box. I accidentally left the port blocked so the initial transfer to the (main campus) DNS server couldn't happen. I fixed that right away, but it hasn't initiated a transfer since then (at least 8 hours).
I've changed records and reloaded the zone, hoping to initiate a notify and thus a transfer, but no dice.
I'm allowing transfers to everyone (I know, I'll lock it back down when this gets fixed);
The other server is listed as a DNS server for the zone;
I have tried setting my server to notify other DNS servers;  then put in the specific IP address;
Neither helped.

Should I be able to see notifications in the Windows Event Log? It shows transfers but I don't see notifications.
Is there anything I can do (other than changing entries in the zone) to force it to send notifications?

Question by:briandunkle
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 2
LVL 71

Expert Comment

by:Chris Dent
ID: 24359455

I don't think notifications are logged. You could increment the serial in the SOA. Does the Unix system have any data for the zone? Would be worth checking what it thinks the SOA and NS are.


Author Comment

ID: 24359543
Sorry; there are really three servers in this situation - the old, BIND server; the current, Windows server; and the main campus server, which is also BIND.

The communication I need is between the new Windows server and the main campus server.

And yes, things worked fine on the previous server on my end.

Anyway: SOA is the Windows server (DNS2), NS are my server and the main campus one - same setup as my old BIND box (DNS).

I just incremented the serial, worth a try but no dice yet.
I can't imagine the main campus server gave up when it couldn't get through for a while.

My Windows box is getting out there as the primary server for that zone - lookups work from the outside world and, after a slight delay, the local caching nameservers. It's just the primary main campus one that doesn't work.

Outside DNS makes its way to the main campus server and gets SERVFAIL twice then goes to mine.

(the point to all this is that the main campus server is supposed to answer most outside traffic and just generally act as a secondary)

Author Comment

ID: 24359553
Oh, and thanks for the comment!
It bites that it doesn't log notifications.
Windows DNS service seems to fall short of BIND in many ways.
Maybe a 3rd-party Windows-based DNS server? :(
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 15

Expert Comment

ID: 24360340

MS Technote:
Using NSlookup.exe
look for the section - Using Nslookup.exe to Transfer Entire Zone

I would suggest from the main campus dns server running nslookup -d

run on bind server at main campus:
server ms-dns-server-ip
ls -d

( use your ms dns server for - ms-dns-server-ip ,
and replace with the real domain.

Also on the zone in your MS DNS be sure that you have the correct ip for notify and to allow transfer.
also firewalls in between need to allow port 53 tcp and udp.

udp is for standard dns, tcp for zone tranfers

you could try wireshark looking at port 53, increment the zone , look at the traffic to your campus dns up - to see if the notifications are going ?

Also you there is bind you can download for windows (I only ever used it for testing)

LVL 71

Accepted Solution

Chris Dent earned 2000 total points
ID: 24362676

You could enable Debug Logging, it's packet logging. Although to capture specifics you're far better off using a packet sniffer, Wireshark ( for example.

Given a choice I would always use BIND for hosting public DNS services. I'll quite happily use MS DNS for AD Domains. It misses out on a lot of functionality when compared with BIND for public hosting.

> SOA is the Windows server (DNS2)

That's in the Secondary Zone at the moment? Might have to look at the zone file to see those.


Author Comment

ID: 24366444
@markpalinux - I don't have access to the main campus server; I've entered a ticket to ask what's going on with the notifies/transfers, but I'm trying to look into it from my end;

@chris-dent - Yeah, I'm realizing how much Windows DNS sucks. I'm trying to move to a Windows box because all the people except one who might back me up if I'm not here are windows-only (they could do a linux box, but it'd be a pain). I need to move it one way or another, the current box for the rest of my DNS is old and in another building (different vlan). I'd just re-number it, but it's a really old redhat and the machine makes me nervous.

I'll try the debug and see if it gives me anything, thanks.

DNS2 is actually the primary now. "DNS" is the old server, which still serves the other 140+ zones, but may be used as a secondary once everything's moved.

Thanks to both of you for replying!

Author Comment

ID: 24388582
Thanks for the tip on debug logging - it gives a better log than I expected, including every notify and response.

Author Closing Comment

ID: 31580324
What I needed to know to get going on it.

Author Comment

ID: 24388803
To clarify for anyone reading this later, the debug logging is a more sophisticated log than I expected - it shows only the DNS-related packets, and annotates them with a handy key at the top.
Stuff like what it is (notify, query), whether it's a response or an origination, and the result. I got this:
20090514 12:15:43 E7C PACKET  01E9A970 UDP Rcv   0000 R N [05a0       REFUSED] SOA   (8)xxx(7)xxx(3)edu(0)
Saying sent a response  to my notify, refusing it.
Now to figure out why. :)

Thanks again.

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

One of the most often confused topics in the area DNS is the idea of GLUE records. Specifically, what they are, when they are needed, when they are provided, and how they are created. First, WHAT IS GLUE? To understand GLUE, you must first under…
I've written instructions for one router type, but this principle may be useful for others of the same brand and even other brands of router. Problem: I had an issue especially with mobile devices that refused to use DNS information supplied via…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question