asked on

DNS Issue - can't get to certain websites. DNS server won't use forwarders

Hello All,
I'm having trouble getting to a few websites on our domain. My DC handles DNS (Server 2008 R2).

Forwarders used: 75.75.75.75 (comcast's preferred DNS server)
8.8.8.8 (googles public dns server)

I can't get to a few sites, most seem to be .gov or .mil sites.. www.mass.gov is one of them..

All workstations are using the DC as the only source for DNS. I can't get to mass.gov, but i looked up the IP address (http://170.63.206.54 ) and that will get me to the website.

I tested that both forwarders can resolve the IP and they both can.
I used nslookup -debug www.mass.gov. 8.8.8.8 -- it resolved to the correct IP.

It appears my DNS server isn't checking with the forwarders -- can anyone help me troubleshoot this?

footech

In the DNS Management console, what results are you getting if you run the tests under the Monitoring tab? On the Forwarders tab, do you have "Use root hints if no forwarders are available"? On the Advanced tab, make sure you don't have "disable recursion" checked.

Also run dcdiag /test:dns /v to see if there's any errors.

Do you have a firewall in front of the network that could be blocking DNS traffic?

You might try removing forwarders and seeing if root hints work for you.

ZabagaR

dnslint.exe is very useful for diagnosing DNS problems in 2008 R2.

http://support.microsoft.com/kb/321045

ASKER CERTIFIED SOLUTION

Dalton1981

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

footech

Thanks for sharing the solution you found. I wonder where the breakage is... In my networks I haven't had to disable EDNS for it to work.

footech

One last point, you might want to try nslookup -type=TXT rs.dns-oarc.net 75.75.75.75 from your network. This will check whether it's Comcast's DNS server that you're using as a forwarder that is blocking.

I already tested 8.8.8.8 and it came back good. If you were to do the same and it was blocked then I would say it's something with your firewall that is limiting.

Lastly, if you're interested in reading more about this: http://msmvps.com/blogs/acefekay/archive/2010/10/11/edns0-extension-mechanisms-for-dns.aspx

Dalton1981

ASKER

I found the solution on another website & shared it