strange dns behaviour

goldie100 used Ask the Experts™
Hi All,

We have a Windows 2003 domain which has been experiencing some unusual symptoms recently

We also use network monitoring software (Netcrunch) which monitors our primary domain and some other domains

The main issue is that when i run a tracert  to any host (in this example - hostb) in any of the other domains the results come back as follows:


Tracing route to

1  1ms
2  1ms

In the above example the server I am running the trace from is dnsserver1 and is hostb

Why does the trace result come back with dnsserver1?  dnsserver1 will show up no matter which host in any of the other domains i try and trace to

The same happens if i try and run a trace from any hosts in our primary domain to the other domains

The net result of this behaviour is that out network monitoring software is showing all hosts in the other domains as the hostname of the network monitoring server:

How it should look (v simplified)

How it does look

Hope my explanation is clearer than mud!

Thanks in advance

Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Looks like you may have been trying to setup a forwarder for the other domains, but actually setup a wildcard dns record. Did you add anything like:
A Record for Domain B
* netmonhost

Hopefully that is clearer than mud too.


Hi Zane thanks for your reply

The strange thing is that nothing has been changed in DNS and all was normal until a couple of days ago.

Some of the domains in question are seen as secondary zones.  A couple have forwarders setup

All the A records for hosts in these domains are correct

I am able to ping the fqdn for any of the hosts in the other domains.  Only seems to be when i trace to the ip it will return the hostname of the machine i'm tracing from !

Also, if i do an nslookup on dnsserver1 for (in a secondary zone) it returns

local host

Should it not return


Does it say
Server: localhost
If so, that would be expected behavior. Make sure if you are doing an nslookup for an IP address you enter:
> set type=ptr

Then you should get the name for that IP address.

When you ping the FQDN, does it return the correct IP Address or does it return the IP address of the machine you are on? I couldn't tell for certain from your response.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!


Hi Zane

No the output is

address: x.x.x.x

name: localhost    -------  this should return the hostname for the target server?

If i set type = prt then lookup it returns 'local host' again - where it should return hostb?

Any ideas?



Anybody else got any ideas on this ?


Does nslookup return the correct values on each system?  Do they resolve each other correctly?

Anything strange to report from Dcdiag /test:DNS

When you say domains- are they AD or DNS or both?

Any strange router configs like ospf?
The problem was with one of our DCs - it was incorrectly forwarding 'local' requests up to our ISP whcih was returning 'local host'

DC was decomissioned anyway so problem solved.  Thanks all


Problem was never solved only worked around

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial