Is my Windows 2003 DNS server sending notifications? Can I force it to?

Posted on 2009-05-11
Last Modified: 2012-05-06
I've been trying to move my zones from a BIND server to a Windows DNS server with embarrassing results. For a couple of zones, Windows rejected some of the old, illegal entries and broke.

Anyway, today's FIRST issue is this: my server doesn't seem to be sending out notifications. I transferred the primary role for the zone from one (BIND) box to a windows box. I accidentally left the port blocked so the initial transfer to the (main campus) DNS server couldn't happen. I fixed that right away, but it hasn't initiated a transfer since then (at least 8 hours).
I've changed records and reloaded the zone, hoping to initiate a notify and thus a transfer, but no dice.
I'm allowing transfers to everyone (I know, I'll lock it back down when this gets fixed);
The other server is listed as a DNS server for the zone;
I have tried setting my server to notify other DNS servers;  then put in the specific IP address;
Neither helped.

Should I be able to see notifications in the Windows Event Log? It shows transfers but I don't see notifications.
Is there anything I can do (other than changing entries in the zone) to force it to send notifications?

Question by:briandunkle
  • 6
  • 2
LVL 70

Expert Comment

by:Chris Dent
ID: 24359455

I don't think notifications are logged. You could increment the serial in the SOA. Does the Unix system have any data for the zone? Would be worth checking what it thinks the SOA and NS are.


Author Comment

ID: 24359543
Sorry; there are really three servers in this situation - the old, BIND server; the current, Windows server; and the main campus server, which is also BIND.

The communication I need is between the new Windows server and the main campus server.

And yes, things worked fine on the previous server on my end.

Anyway: SOA is the Windows server (DNS2), NS are my server and the main campus one - same setup as my old BIND box (DNS).

I just incremented the serial, worth a try but no dice yet.
I can't imagine the main campus server gave up when it couldn't get through for a while.

My Windows box is getting out there as the primary server for that zone - lookups work from the outside world and, after a slight delay, the local caching nameservers. It's just the primary main campus one that doesn't work.

Outside DNS makes its way to the main campus server and gets SERVFAIL twice then goes to mine.

(the point to all this is that the main campus server is supposed to answer most outside traffic and just generally act as a secondary)

Author Comment

ID: 24359553
Oh, and thanks for the comment!
It bites that it doesn't log notifications.
Windows DNS service seems to fall short of BIND in many ways.
Maybe a 3rd-party Windows-based DNS server? :(
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

LVL 15

Expert Comment

ID: 24360340

MS Technote:
Using NSlookup.exe
look for the section - Using Nslookup.exe to Transfer Entire Zone

I would suggest from the main campus dns server running nslookup -d

run on bind server at main campus:
server ms-dns-server-ip
ls -d

( use your ms dns server for - ms-dns-server-ip ,
and replace with the real domain.

Also on the zone in your MS DNS be sure that you have the correct ip for notify and to allow transfer.
also firewalls in between need to allow port 53 tcp and udp.

udp is for standard dns, tcp for zone tranfers

you could try wireshark looking at port 53, increment the zone , look at the traffic to your campus dns up - to see if the notifications are going ?

Also you there is bind you can download for windows (I only ever used it for testing)

LVL 70

Accepted Solution

Chris Dent earned 500 total points
ID: 24362676

You could enable Debug Logging, it's packet logging. Although to capture specifics you're far better off using a packet sniffer, Wireshark ( for example.

Given a choice I would always use BIND for hosting public DNS services. I'll quite happily use MS DNS for AD Domains. It misses out on a lot of functionality when compared with BIND for public hosting.

> SOA is the Windows server (DNS2)

That's in the Secondary Zone at the moment? Might have to look at the zone file to see those.


Author Comment

ID: 24366444
@markpalinux - I don't have access to the main campus server; I've entered a ticket to ask what's going on with the notifies/transfers, but I'm trying to look into it from my end;

@chris-dent - Yeah, I'm realizing how much Windows DNS sucks. I'm trying to move to a Windows box because all the people except one who might back me up if I'm not here are windows-only (they could do a linux box, but it'd be a pain). I need to move it one way or another, the current box for the rest of my DNS is old and in another building (different vlan). I'd just re-number it, but it's a really old redhat and the machine makes me nervous.

I'll try the debug and see if it gives me anything, thanks.

DNS2 is actually the primary now. "DNS" is the old server, which still serves the other 140+ zones, but may be used as a secondary once everything's moved.

Thanks to both of you for replying!

Author Comment

ID: 24388582
Thanks for the tip on debug logging - it gives a better log than I expected, including every notify and response.

Author Closing Comment

ID: 31580324
What I needed to know to get going on it.

Author Comment

ID: 24388803
To clarify for anyone reading this later, the debug logging is a more sophisticated log than I expected - it shows only the DNS-related packets, and annotates them with a handy key at the top.
Stuff like what it is (notify, query), whether it's a response or an origination, and the result. I got this:
20090514 12:15:43 E7C PACKET  01E9A970 UDP Rcv   0000 R N [05a0       REFUSED] SOA   (8)xxx(7)xxx(3)edu(0)
Saying sent a response  to my notify, refusing it.
Now to figure out why. :)

Thanks again.

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
What is this Task? 4 111
MacBook wifi issues 6 39
SharePoint 2013 to SharePoint Online migration:  (links) 2 34
Server 2016: DNS on the server or router? Advices? 4 22
Many of us need to configure DHCP server(s) in their environment. We can do that simply via DHCP console on server or using MMC snap-in on each computer with Administrative Tools installed in a network. But what if we have to configure many DHCP ser…
Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
In a recent question ( here at Experts Exchange, a member asked how to add page numbers to a PDF file using Adobe Acrobat XI Pro. This short video Micro Tutorial sh…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question