Domain trust - dns forwarders cannot be resolved

Hi All,

I have 4 different domains in four different locations.

HeadOffice main.local - win2008
Branch1 Office domain1.local - win2003
Branch2 office domain2.local - win2003
branch3 office domain3.local - win2003

Head office has IPsec VPN between each branch. From head office i can ping each branch's domain controller by IP address (not by name)

I want to establish domain trust between head office and each branch.
I opened DNS (head office main.local) and wanted to add forwarder but it times out and is unable to resolve.

Any idea why ?

do i have to open any ports on firewall ? ( head office has CISCO ASA 5510 and each branch has CISCO 800Series ADSL router)

Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

DNS uses Port 53, have a look at the firewall log to see if requests are blocked.
You can test connectivity for DNS this way...

at a command prompt...

NSLOOKUP  <enter>
Server <xx.xx.xx.xx>  <enter>    ----- where xx.xx.xx.xx is the ip address of the remote dns server

then type the remote server name <enter> to attempt a query

if the server responds with the ip address, your port is open for dns...

or you can use the telnet port test...

at a command prompt

telnet xx.xx.xx.xx 53  <enter>  

if a blank page appears, you have connectivity ...if error occurs, you do not have connectivity.

"I opened DNS (head office main.local) and wanted to add forwarder but it times out and is unable to resolve."  So, you should probably leave forwarding alone... so that each site can forward to thier ISP's for internet resolution.  Instead, you might consider making Secondary zones on each DNS server for the remote DNS servers...and adding DNS suffixes for the remote domains.


On the main site... create a secondary zone in DNS...  say for domain1.local  (the wizard will ask you for the IP address of the remote DNS server)  After the wizard runs, you will have an additional forward lookup zone... in DNS, it will copy of the records from the domain1.local zone to your main site server.  If you then go into the TCP/IP properties of the main site server DNS tab and add an additional dns suffix called domain1.local  and hit Ok... yo uwill be able to resolve the computers in the remote domain (assuming that you have firewall ports opened).

Do this for each remote domain...

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Acronis True Image 2019 just released!

Create a reliable backup. Make sure you always have dependable copies of your data so you can restore your entire system or individual files.

Branch1 Office domain1.local - win2003
Here you can resolve only DNS Names of domain1.local at present.

To resolve DNS Name of domain2 or domain3 you can configured a conditional Forwarder for domain2 and domain3.


You can setup a Stubzone for domain2 and another one for domain3.


If you want to transfer the complete zones as a secondary Zone from domain2 to domain1 and domain3 to domain1 you have to allow the transfer from DNS Server to the DNS Server. Have a look at the properties of the zones to allow this.
aucklandnzAuthor Commented:
i did telnet on 53 from head office to my branch and from branch to head office and i get blank screen

but when i go to dns and try to add secondary zone or stubzone it fails to resolve

Did you allow the transfer of the zone?
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.