Domain trust - dns forwarders cannot be resolved

Hi All,

I have 4 different domains in four different locations.

HeadOffice main.local - win2008
Branch1 Office domain1.local - win2003
Branch2 office domain2.local - win2003
branch3 office domain3.local - win2003

Head office has IPsec VPN between each branch. From head office i can ping each branch's domain controller by IP address (not by name)

I want to establish domain trust between head office and each branch.
I opened DNS (head office main.local) and wanted to add forwarder but it times out and is unable to resolve.

Any idea why ?

do i have to open any ports on firewall ? ( head office has CISCO ASA 5510 and each branch has CISCO 800Series ADSL router)

Who is Participating?
NJComputerNetworksConnect With a Mentor Commented:
"I opened DNS (head office main.local) and wanted to add forwarder but it times out and is unable to resolve."  So, you should probably leave forwarding alone... so that each site can forward to thier ISP's for internet resolution.  Instead, you might consider making Secondary zones on each DNS server for the remote DNS servers...and adding DNS suffixes for the remote domains.


On the main site... create a secondary zone in DNS...  say for domain1.local  (the wizard will ask you for the IP address of the remote DNS server)  After the wizard runs, you will have an additional forward lookup zone... in DNS, it will copy of the records from the domain1.local zone to your main site server.  If you then go into the TCP/IP properties of the main site server DNS tab and add an additional dns suffix called domain1.local  and hit Ok... yo uwill be able to resolve the computers in the remote domain (assuming that you have firewall ports opened).

Do this for each remote domain...
DNS uses Port 53, have a look at the firewall log to see if requests are blocked.
You can test connectivity for DNS this way...

at a command prompt...

NSLOOKUP  <enter>
Server <xx.xx.xx.xx>  <enter>    ----- where xx.xx.xx.xx is the ip address of the remote dns server

then type the remote server name <enter> to attempt a query

if the server responds with the ip address, your port is open for dns...

or you can use the telnet port test...

at a command prompt

telnet xx.xx.xx.xx 53  <enter>  

if a blank page appears, you have connectivity ...if error occurs, you do not have connectivity.

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Branch1 Office domain1.local - win2003
Here you can resolve only DNS Names of domain1.local at present.

To resolve DNS Name of domain2 or domain3 you can configured a conditional Forwarder for domain2 and domain3.


You can setup a Stubzone for domain2 and another one for domain3.


If you want to transfer the complete zones as a secondary Zone from domain2 to domain1 and domain3 to domain1 you have to allow the transfer from DNS Server to the DNS Server. Have a look at the properties of the zones to allow this.
aucklandnzAuthor Commented:
i did telnet on 53 from head office to my branch and from branch to head office and i get blank screen

but when i go to dns and try to add secondary zone or stubzone it fails to resolve

Did you allow the transfer of the zone?
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.