Solved

DNS Forwarder resolution of local records

Posted on 2012-12-20
8
1,364 Views
Last Modified: 2012-12-20
Hello EE Ninjas,

Primer: DNS issue. Windows mixed domain (nbsrealtors.com) with both 2003 and 2008 servers. Currently four DNS servers in three different subnets. Most recently added dns server is 2008, all others 2003.  

So, I've been experiencing occasional odd little DNS issues on my network ever since starting at my company three years ago.  Example, every now and then a client will not be able to resolve a server name.  When that happens, a flushdns or reboot seems to correct the issue.  Occasionally, it doesn't and I add the server info to the clients hosts file. These issues have been rare and never enough to warrant a deep investigation of the issue - just didn't have the time.

The issue has come to a head with the addition of a secondary dns server in our primary home office subnet.  Name resolution works fine, but when adding new computers to the domain, I am receiving an RPC error.  In troubleshooting this issue, I have run a DCDIAG DNSTEST and am receiving the following error info withing the results.

The origininal dns server and primary domain controller for the domain is pdxad at 10.1.1.1

The recently added 2008 dns server and secondary dc is pdxdc at 10.1.1.11

The dns forwarding servers from our ISP are 209.63.0.6 and 204.130.255.3, neither of which are pingable.

So, my questions -  Is it normal for DNS to attempt to resolve records like

_kerberos._tcp.dc._msdcs.corp.nbsrealtors.com
_ldap._tcp.corp.nbsrealtors.com
_kerberos._tcp.corp.nbsrealtors.com
etc.

...against the forwarding server addresses, as seems to be happening below?  If this is normal, are the failures in the below report anything to be concerned about?  If they are not normal, is there some way to istruct DNS to not attempt resolving these local records against those forwarding domains?



Thanks for any insight on this.  Much appreciated!

Ken



               TEST: Records registration (RReg)
                  Network Adapter

                  [00000007] Intel(R) PRO/1000 MT Network Connection:

                     Matching CNAME record found at DNS server 10.1.1.1:
                     17f447cc-5493-47a9-81fa-c99bdb692849._msdcs.corp.nbsrealtors.com

                     Matching A record found at DNS server 10.1.1.1:
                     PDXDC.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _ldap._tcp.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _ldap._tcp.4dfb845e-dc87-43c6-91c9-60c68be19c3f.domains._msdcs.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _kerberos._tcp.dc._msdcs.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _ldap._tcp.dc._msdcs.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _kerberos._tcp.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _kerberos._udp.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _kpasswd._tcp.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _ldap._tcp.PDX._sites.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _kerberos._tcp.PDX._sites.dc._msdcs.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _ldap._tcp.PDX._sites.dc._msdcs.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _kerberos._tcp.PDX._sites.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _ldap._tcp.gc._msdcs.corp.nbsrealtors.com

                     Matching A record found at DNS server 10.1.1.1:
                     gc._msdcs.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _gc._tcp.PDX._sites.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.1:
                     _ldap._tcp.PDX._sites.gc._msdcs.corp.nbsrealtors.com

                     Warning:
                     Missing CNAME record at DNS server 204.130.255.3:
                     17f447cc-5493-47a9-81fa-c99bdb692849._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Warning:
                     Missing A record at DNS server 204.130.255.3:
                     PDXDC.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _ldap._tcp.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _ldap._tcp.4dfb845e-dc87-43c6-91c9-60c68be19c3f.domains._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _kerberos._tcp.dc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _ldap._tcp.dc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _kerberos._tcp.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _kerberos._udp.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _kpasswd._tcp.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _ldap._tcp.PDX._sites.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _kerberos._tcp.PDX._sites.dc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _ldap._tcp.PDX._sites.dc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _kerberos._tcp.PDX._sites.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _ldap._tcp.gc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Warning:
                     Missing A record at DNS server 204.130.255.3:
                     gc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _gc._tcp.PDX._sites.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 204.130.255.3:
                     _ldap._tcp.PDX._sites.gc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Warning:
                     Missing CNAME record at DNS server 209.63.0.6:
                     17f447cc-5493-47a9-81fa-c99bdb692849._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Warning:
                     Missing A record at DNS server 209.63.0.6:
                     PDXDC.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _ldap._tcp.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _ldap._tcp.4dfb845e-dc87-43c6-91c9-60c68be19c3f.domains._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _kerberos._tcp.dc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _ldap._tcp.dc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _kerberos._tcp.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _kerberos._udp.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _kpasswd._tcp.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _ldap._tcp.PDX._sites.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _kerberos._tcp.PDX._sites.dc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _ldap._tcp.PDX._sites.dc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _kerberos._tcp.PDX._sites.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _ldap._tcp.gc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Warning:
                     Missing A record at DNS server 209.63.0.6:
                     gc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _gc._tcp.PDX._sites.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Error:
                     Missing SRV record at DNS server 209.63.0.6:
                     _ldap._tcp.PDX._sites.gc._msdcs.corp.nbsrealtors.com
                     [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
                     
                     Matching CNAME record found at DNS server 10.1.1.11:
                     17f447cc-5493-47a9-81fa-c99bdb692849._msdcs.corp.nbsrealtors.com

                     Matching A record found at DNS server 10.1.1.11:
                     PDXDC.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _ldap._tcp.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _ldap._tcp.4dfb845e-dc87-43c6-91c9-60c68be19c3f.domains._msdcs.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _kerberos._tcp.dc._msdcs.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _ldap._tcp.dc._msdcs.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _kerberos._tcp.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _kerberos._udp.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _kpasswd._tcp.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _ldap._tcp.PDX._sites.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _kerberos._tcp.PDX._sites.dc._msdcs.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _ldap._tcp.PDX._sites.dc._msdcs.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _kerberos._tcp.PDX._sites.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _ldap._tcp.gc._msdcs.corp.nbsrealtors.com

                     Matching A record found at DNS server 10.1.1.11:
                     gc._msdcs.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _gc._tcp.PDX._sites.corp.nbsrealtors.com

                     Matching  SRV record found at DNS server 10.1.1.11:
                     _ldap._tcp.PDX._sites.gc._msdcs.corp.nbsrealtors.com

               Error: Record registrations cannot be found for all the network

               adapters

         
         Summary of test results for DNS servers used by the above domain

         controllers:

         

            DNS server: 209.63.0.6 (<name unavailable>)

               6 test failure on this DNS server

               Name resolution is not functional. _ldap._tcp.corp.nbsrealtors.com. failed on the DNS server 209.63.0.6
               [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
               
            DNS server: 204.130.255.3 (<name unavailable>)

               4 test failure on this DNS server

               Name resolution is not functional. _ldap._tcp.corp.nbsrealtors.com. failed on the DNS server 204.130.255.3
               [Error details: 9003 (Type: Win32 - Description: DNS name does not exist.)]
               
            DNS server: 198.32.64.12 (l.root-servers.net.)

               2 test failure on this DNS server

               PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 198.32.64.12               [Error details: 1460 (Type: Win32 - Description: This operation returned because the timeout period expired.)]
               
            DNS server: 10.1.1.1 (PDXAD)

               All tests passed on this DNS server

               Name resolution is functional._ldap._tcp SRV record for the forest root domain is registered
               
            DNS server: 10.1.1.11 (PDXDC)

               All tests passed on this DNS server

               Name resolution is functional._ldap._tcp SRV record for the forest root domain is registered
               
            DNS server: 10.2.1.1 (VANDC)

               All tests passed on this DNS server

               Name resolution is functional._ldap._tcp SRV record for the forest root domain is registered
               
            DNS server: 10.3.1.1 (SEADC)

               All tests passed on this DNS server

               Name resolution is functional._ldap._tcp SRV record for the forest root domain is registered
               
            DNS server: 128.63.2.53 (h.root-servers.net.)

               All tests passed on this DNS server

               
            DNS server: 128.8.10.90 (d.root-servers.net.)

               All tests passed on this DNS server

               
            DNS server: 192.112.36.4 (g.root-servers.net.)

               All tests passed on this DNS server

               
            DNS server: 192.203.230.10 (e.root-servers.net.)

               All tests passed on this DNS server

               
            DNS server: 192.228.79.201 (b.root-servers.net.)

               All tests passed on this DNS server

               
            DNS server: 192.33.4.12 (c.root-servers.net.)

               All tests passed on this DNS server

               
            DNS server: 192.36.148.17 (i.root-servers.net.)

               All tests passed on this DNS server

               
            DNS server: 192.5.5.241 (f.root-servers.net.)

               All tests passed on this DNS server

               
            DNS server: 192.58.128.30 (j.root-servers.net.)

               All tests passed on this DNS server

               
            DNS server: 193.0.14.129 (k.root-servers.net.)

               All tests passed on this DNS server

               
            DNS server: 198.41.0.4 (a.root-servers.net.)

               All tests passed on this DNS server

               
            DNS server: 202.12.27.33 (m.root-servers.net.)

               All tests passed on this DNS server

               
            DNS server: 207.173.86.6 (<name unavailable>)

               All tests passed on this DNS server

               
         Summary of DNS test results:

         
                                            Auth Basc Forw Del  Dyn  RReg Ext
            _________________________________________________________________
            Domain: corp.nbsrealtors.com

               PDXAD                        PASS WARN FAIL PASS PASS FAIL n/a  
               seadc                        PASS PASS PASS PASS PASS PASS n/a  
               vandc                        PASS PASS PASS PASS PASS PASS n/a  
               PDXDC                        PASS WARN FAIL PASS PASS FAIL n/a  
         
         ......................... corp.nbsrealtors.com failed test DNS

      Test omitted by user request: LocatorCheck

      Test omitted by user request: Intersite
0
Comment
Question by:Ken Moody
  • 2
  • 2
  • 2
  • +2
8 Comments
 
LVL 11

Accepted Solution

by:
BillBondo earned 167 total points
ID: 38710197
When setting up my dns servers I never use any address except that of itself. I never add forwarders or reverse look ups. Some people do I dont. Also I just leave the root servers as is. Never have issues.
0
 

Author Comment

by:Ken Moody
ID: 38710212
Interesting.  So how do your servers & client know how to resolve DNS requests?  They just request against the default root hint servers?
0
 
LVL 25

Assisted Solution

by:DrDave242
DrDave242 earned 167 total points
ID: 38710274
Root hints and forwarders are both acceptable methods of handling external DNS queries.  Each has its own set of advantages and disadvantages, so in most cases it comes down to personal preference.

In your particular case, those SRV queries should never be sent outside, as all of your internal servers should be authoritative for the corp.nbsrealtors.com zone.  Is the server you ran the test on only using those internal DNS servers for resolution, or are the ISP servers configured as alternates?  (Ipconfig /all will show this.)
0
 
LVL 38

Assisted Solution

by:Hypercat (Deb)
Hypercat (Deb) earned 166 total points
ID: 38710283
I'm in agreement with BillBondo - I do not generally use forwarders either.  I've had too many instances where DNS issues cropped up and were actually caused by misbehaving DNS forwarders.  What happens when you remove the forwarders is simply that your DNS servers will query the root servers directly, instead of the forwarders, for the correct NS servers for the particular domain you're querying, and then will go to those NS servers to find the domain host IP addresses that it needs.

If you want to stop using forwarders, all you need to do is make sure that the root hints tab shows the list of root servers and IP addresses, and remove the forwarders from your DNS servers.  In particular, on your 2008 DNS server, you need to double-check the settings to make sure that it will look at the root hints instead of forwarders, and has a list of root servers, as this is not set up automatically all the time as it is on 2003 DNS servers.
0
 
LVL 6

Expert Comment

by:traoher
ID: 38710355
If local entries are not found, forwarder is always query.  This is to ensure you can always resolve system you do know now before hand.

What's the primary DNS entry for those DNS servers?
0
 
LVL 25

Expert Comment

by:DrDave242
ID: 38710402
If local entries are not found, forwarder is always query.  This is to ensure you can always resolve system you do know now before hand.
That's not correct.  A DNS server will never forward queries for anything in a zone that it's authoritative for (a zone that's actually present on that server, in other words).  If it doesn't find a record matching the query, it will simply send an authoritative negative response.

For example, assume your DNS server hosts the mydomain.local forward lookup zone and you query for the address of win7client.mydomain.local.  If there's a host record with that name on the server, it'll return that machine's IP address, but if there's no host record with that name, it'll return NXDOMAIN, which basically means, "The query was valid, but that name doesn't exist."  It won't query a forwarder or a root server, since it's authoritative for the zone.
0
 
LVL 6

Expert Comment

by:traoher
ID: 38710573
Dr.Dave is correct, for zones it has Auth. it will send "unknown host" and ends the query.

I was implying external known root domains.
0
 

Author Comment

by:Ken Moody
ID: 38710866
Maybe I'm misreading the results of the test, but it sure looks like it's trying to resolve a local root domain name against an external forwarder, based on the results above, doesn't it?  

Regardless, I have removed the forwarding addresses, making sure all dns servers have the appropriate root hints in place, and everything seems to be running smoothly.  I re-ran the dcdiag and it's not failing the forwarding part of the test.

Oh, and I did discover that the adapters for each dc also had the dns resolver addresses added in the adapter dns settings, so I dumped those as well.

So I guess that's that issue.  This is just part of a larger RPC issue, but I'm still cracking away at that one, and if I cannot resolve it (heh, no pun intended), then you can anticipate another post shortly.

Thanks a ton for the responses folks, and have a great holiday!

KM
0

Join & Write a Comment

Suggested Solutions

Many of us in IT utilize a combination of roaming profiles and folder redirection to ensure user information carries over from one workstation to another; in my environment, it was to enable virtualization without needing a separate desktop for each…
Are you one of those front-line IT Service Desk staff fielding calls, replying to emails, all-the-while working to resolve end-user technological nightmares? I am! That's why I have put together this brief overview of tools and techniques I use in o…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now