JA Network
asked on
Server failed DCDIAG DNS tests
I'm installing a new server that is supposed to take over the functionality of one of my DCs (AD, dhcp, & dns) and ran the DCDIAG dns test on both of them. I got different results surprisingly and wanted to know if anyone had some insight on this. Sorry for the long paste , but I think only the bottom couple lines of each test are relevant, yes? I ran the same test on both of my DCs (server1 and server2).
Test on Server1:
**************************
C:\Users\admin>dcdiag /test:dns /s:172.20.3.4
Directory Server Diagnosis
Performing initial setup:
[172.20.3.4] Directory Binding Error 87:
The parameter is incorrect.
This may limit some of the tests that can be performed.
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MyNetwork\server1
Starting test: Connectivity
......................... server1 passed test Connectivity
Doing primary tests
Testing server: MyNetwork\server1
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... server1 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : MyNetwork
Running enterprise tests on : MyNetwork.net
Starting test: DNS
Test results for domain controllers:
DC: server1.MyNetwork.net
Domain: MyNetwork.net
TEST: Basic (Basc)
Warning: adapter
[00000006] Broadcom NetXtreme Gigabit Ethernet has invalid
DNS server: 64.71.0.34 (<name unavailable>)
Warning: adapter
[00000006] Broadcom NetXtreme Gigabit Ethernet has invalid
DNS server: 64.71.0.60 (<name unavailable>)
Warning: The AAAA record for this DC was not found
TEST: Forwarders/Root hints (Forw)
Error: Forwarders list has invalid forwarder: 64.71.0.34 (<name unavailable>)
Error: Forwarders list has invalid forwarder: 64.71.0.60 (<name unavailable>)
TEST: Records registration (RReg)
Network Adapter
[00000006] Broadcom NetXtreme Gigabit Ethernet:
Warning:
Missing AAAA record at DNS server 172.20.3.4:
server1.MyNetwork.net
Warning:
Missing AAAA record at DNS server 172.20.3.4:
gc._msdcs.MyNetwork.net
Warning:
Missing CNAME record at DNS server 64.71.0.34:
615eb59f-0e0b-426c-9f40-e0
Warning:
Missing A record at DNS server 64.71.0.34:
server1.MyNetwork.net
Warning:
Missing AAAA record at DNS server 64.71.0.34:
server1.MyNetwork.net
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.MyNetwork.net
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.ff6b2609-1763-4
Error:
Missing SRV record at DNS server 64.71.0.34:
_kerberos._tcp.dc._msdcs.M
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.dc._msdcs.MyNet
Error:
Missing SRV record at DNS server 64.71.0.34:
_kerberos._tcp.MyNetwork.n
Error:
Missing SRV record at DNS server 64.71.0.34:
_kerberos._udp.MyNetwork.n
Error:
Missing SRV record at DNS server 64.71.0.34:
_kpasswd._tcp.MyNetwork.ne
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.MyNetwork._site
Error:
Missing SRV record at DNS server 64.71.0.34:
_kerberos._tcp.MyNetwork._
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.MyNetwork._site
Error:
Missing SRV record at DNS server 64.71.0.34:
_kerberos._tcp.MyNetwork._
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.gc._msdcs.MyNet
Warning:
Missing A record at DNS server 64.71.0.34:
gc._msdcs.MyNetwork.net
Warning:
Missing AAAA record at DNS server 64.71.0.34:
gc._msdcs.MyNetwork.net
Error:
Missing SRV record at DNS server 64.71.0.34:
_gc._tcp.MyNetwork._sites.
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.MyNetwork._site
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.pdc._msdcs.MyNe
Warning:
Missing CNAME record at DNS server 64.71.0.60:
615eb59f-0e0b-426c-9f40-e0
Warning:
Missing A record at DNS server 64.71.0.60:
server1.MyNetwork.net
Warning:
Missing AAAA record at DNS server 64.71.0.60:
server1.MyNetwork.net
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.MyNetwork.net
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.ff6b2609-1763-4
Error:
Missing SRV record at DNS server 64.71.0.60:
_kerberos._tcp.dc._msdcs.M
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.dc._msdcs.MyNet
Error:
Missing SRV record at DNS server 64.71.0.60:
_kerberos._tcp.MyNetwork.n
Error:
Missing SRV record at DNS server 64.71.0.60:
_kerberos._udp.MyNetwork.n
Error:
Missing SRV record at DNS server 64.71.0.60:
_kpasswd._tcp.MyNetwork.ne
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.MyNetwork._site
Error:
Missing SRV record at DNS server 64.71.0.60:
_kerberos._tcp.MyNetwork._
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.MyNetwork._site
Error:
Missing SRV record at DNS server 64.71.0.60:
_kerberos._tcp.MyNetwork._
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.gc._msdcs.MyNet
Warning:
Missing A record at DNS server 64.71.0.60:
gc._msdcs.MyNetwork.net
Warning:
Missing AAAA record at DNS server 64.71.0.60:
gc._msdcs.MyNetwork.net
Error:
Missing SRV record at DNS server 64.71.0.60:
_gc._tcp.MyNetwork._sites.
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.MyNetwork._site
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.pdc._msdcs.MyNe
Error: Record registrations cannot be found for all the network
adapters
Summary of test results for DNS servers used by the above domain
controllers:
DNS server: 64.71.0.34 (<name unavailable>)
2 test failure on this DNS server
Name resolution is not functional. _ldap._tcp.MyNetwork.net. failed on the DNS server 64.71.0.34
DNS server: 64.71.0.60 (<name unavailable>)
2 test failure on this DNS server
Name resolution is not functional. _ldap._tcp.MyNetwork.net. failed on the DNS server 64.71.0.60
Summary of DNS test results:
Auth Basc Forw Del Dyn RReg Ext
__________________________
Domain: MyNetwork.net
server1 PASS WARN FAIL PASS PASS FAIL n/a
......................... MyNetwork.net failed test DNS
**************************
And test on Server 2:
**************************
C:\Users\admin>dcdiag /test:dns /s:172.20.3.5
Directory Server Diagnosis
Performing initial setup:
[172.20.3.5] Directory Binding Error 87:
The parameter is incorrect.
This may limit some of the tests that can be performed.
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MyNetwork\server2
Starting test: Connectivity
......................... server2 passed test Connectivity
Doing primary tests
Testing server: MyNetwork\server2
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... server2 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : MyNetwork
Running enterprise tests on : MyNetwork.net
Starting test: DNS
Test results for domain controllers:
DC: server2.MyNetwork.net
Domain: MyNetwork.net
TEST: Basic (Basc)
Warning: The AAAA record for this DC was not found
TEST: Records registration (RReg)
Network Adapter
[00000006] Broadcom NetXtreme Gigabit Ethernet:
Warning:
Missing AAAA record at DNS server 172.20.3.5:
server2.MyNetwork.net
Warning: Record Registrations not found in some network adapters
server2 PASS WARN PASS PASS PASS WARN n/a
......................... MyNetwork.net passed test DNS
**************************
Any thoughts on why these two results are different?
Thanks so much!
Test on Server1:
**************************
C:\Users\admin>dcdiag /test:dns /s:172.20.3.4
Directory Server Diagnosis
Performing initial setup:
[172.20.3.4] Directory Binding Error 87:
The parameter is incorrect.
This may limit some of the tests that can be performed.
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MyNetwork\server1
Starting test: Connectivity
......................... server1 passed test Connectivity
Doing primary tests
Testing server: MyNetwork\server1
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... server1 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : MyNetwork
Running enterprise tests on : MyNetwork.net
Starting test: DNS
Test results for domain controllers:
DC: server1.MyNetwork.net
Domain: MyNetwork.net
TEST: Basic (Basc)
Warning: adapter
[00000006] Broadcom NetXtreme Gigabit Ethernet has invalid
DNS server: 64.71.0.34 (<name unavailable>)
Warning: adapter
[00000006] Broadcom NetXtreme Gigabit Ethernet has invalid
DNS server: 64.71.0.60 (<name unavailable>)
Warning: The AAAA record for this DC was not found
TEST: Forwarders/Root hints (Forw)
Error: Forwarders list has invalid forwarder: 64.71.0.34 (<name unavailable>)
Error: Forwarders list has invalid forwarder: 64.71.0.60 (<name unavailable>)
TEST: Records registration (RReg)
Network Adapter
[00000006] Broadcom NetXtreme Gigabit Ethernet:
Warning:
Missing AAAA record at DNS server 172.20.3.4:
server1.MyNetwork.net
Warning:
Missing AAAA record at DNS server 172.20.3.4:
gc._msdcs.MyNetwork.net
Warning:
Missing CNAME record at DNS server 64.71.0.34:
615eb59f-0e0b-426c-9f40-e0
Warning:
Missing A record at DNS server 64.71.0.34:
server1.MyNetwork.net
Warning:
Missing AAAA record at DNS server 64.71.0.34:
server1.MyNetwork.net
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.MyNetwork.net
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.ff6b2609-1763-4
Error:
Missing SRV record at DNS server 64.71.0.34:
_kerberos._tcp.dc._msdcs.M
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.dc._msdcs.MyNet
Error:
Missing SRV record at DNS server 64.71.0.34:
_kerberos._tcp.MyNetwork.n
Error:
Missing SRV record at DNS server 64.71.0.34:
_kerberos._udp.MyNetwork.n
Error:
Missing SRV record at DNS server 64.71.0.34:
_kpasswd._tcp.MyNetwork.ne
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.MyNetwork._site
Error:
Missing SRV record at DNS server 64.71.0.34:
_kerberos._tcp.MyNetwork._
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.MyNetwork._site
Error:
Missing SRV record at DNS server 64.71.0.34:
_kerberos._tcp.MyNetwork._
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.gc._msdcs.MyNet
Warning:
Missing A record at DNS server 64.71.0.34:
gc._msdcs.MyNetwork.net
Warning:
Missing AAAA record at DNS server 64.71.0.34:
gc._msdcs.MyNetwork.net
Error:
Missing SRV record at DNS server 64.71.0.34:
_gc._tcp.MyNetwork._sites.
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.MyNetwork._site
Error:
Missing SRV record at DNS server 64.71.0.34:
_ldap._tcp.pdc._msdcs.MyNe
Warning:
Missing CNAME record at DNS server 64.71.0.60:
615eb59f-0e0b-426c-9f40-e0
Warning:
Missing A record at DNS server 64.71.0.60:
server1.MyNetwork.net
Warning:
Missing AAAA record at DNS server 64.71.0.60:
server1.MyNetwork.net
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.MyNetwork.net
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.ff6b2609-1763-4
Error:
Missing SRV record at DNS server 64.71.0.60:
_kerberos._tcp.dc._msdcs.M
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.dc._msdcs.MyNet
Error:
Missing SRV record at DNS server 64.71.0.60:
_kerberos._tcp.MyNetwork.n
Error:
Missing SRV record at DNS server 64.71.0.60:
_kerberos._udp.MyNetwork.n
Error:
Missing SRV record at DNS server 64.71.0.60:
_kpasswd._tcp.MyNetwork.ne
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.MyNetwork._site
Error:
Missing SRV record at DNS server 64.71.0.60:
_kerberos._tcp.MyNetwork._
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.MyNetwork._site
Error:
Missing SRV record at DNS server 64.71.0.60:
_kerberos._tcp.MyNetwork._
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.gc._msdcs.MyNet
Warning:
Missing A record at DNS server 64.71.0.60:
gc._msdcs.MyNetwork.net
Warning:
Missing AAAA record at DNS server 64.71.0.60:
gc._msdcs.MyNetwork.net
Error:
Missing SRV record at DNS server 64.71.0.60:
_gc._tcp.MyNetwork._sites.
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.MyNetwork._site
Error:
Missing SRV record at DNS server 64.71.0.60:
_ldap._tcp.pdc._msdcs.MyNe
Error: Record registrations cannot be found for all the network
adapters
Summary of test results for DNS servers used by the above domain
controllers:
DNS server: 64.71.0.34 (<name unavailable>)
2 test failure on this DNS server
Name resolution is not functional. _ldap._tcp.MyNetwork.net. failed on the DNS server 64.71.0.34
DNS server: 64.71.0.60 (<name unavailable>)
2 test failure on this DNS server
Name resolution is not functional. _ldap._tcp.MyNetwork.net. failed on the DNS server 64.71.0.60
Summary of DNS test results:
Auth Basc Forw Del Dyn RReg Ext
__________________________
Domain: MyNetwork.net
server1 PASS WARN FAIL PASS PASS FAIL n/a
......................... MyNetwork.net failed test DNS
**************************
And test on Server 2:
**************************
C:\Users\admin>dcdiag /test:dns /s:172.20.3.5
Directory Server Diagnosis
Performing initial setup:
[172.20.3.5] Directory Binding Error 87:
The parameter is incorrect.
This may limit some of the tests that can be performed.
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MyNetwork\server2
Starting test: Connectivity
......................... server2 passed test Connectivity
Doing primary tests
Testing server: MyNetwork\server2
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... server2 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : MyNetwork
Running enterprise tests on : MyNetwork.net
Starting test: DNS
Test results for domain controllers:
DC: server2.MyNetwork.net
Domain: MyNetwork.net
TEST: Basic (Basc)
Warning: The AAAA record for this DC was not found
TEST: Records registration (RReg)
Network Adapter
[00000006] Broadcom NetXtreme Gigabit Ethernet:
Warning:
Missing AAAA record at DNS server 172.20.3.5:
server2.MyNetwork.net
Warning: Record Registrations not found in some network adapters
server2 PASS WARN PASS PASS PASS WARN n/a
......................... MyNetwork.net passed test DNS
**************************
Any thoughts on why these two results are different?
Thanks so much!
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
ok! thanks for the clear instructions! I'll remove those entries in the screenshot and then follow your directions when I get a chance tomorrow and let you know what happens...
One quick question..
Should I do anything in the A records like you mentioned in the first response? Or just leave it alone, once I follow what you wrote in the 2nd response.
One quick question..
Should I do anything in the A records like you mentioned in the first response? Or just leave it alone, once I follow what you wrote in the 2nd response.
Leave the records for now and just reconfigure the NICs.
ASKER
NICs reconfigured! Removed those three entries and then added the 2 DNS server addresses in the Forwarders tab in DNS Mgmt. Here are the latest results...some improvements, but there are still some stuff I was wondering about..
***************
C:\Users\admin>dcdiag /test:dns /s:172.20.3.4
Directory Server Diagnosis
Performing initial setup:
[172.20.3.4] Directory Binding Error 87:
The parameter is incorrect.
This may limit some of the tests that can be performed.
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MyNetwork\Server1
Starting test: Connectivity
......................... Server1 passed test Connectivity
Doing primary tests
Testing server: MyNetwork\Server1
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... Server1 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : MyNetwork
Running enterprise tests on : MyNetwork.net
Starting test: DNS
Test results for domain controllers:
DC: Server1.MyNetwork.net
Domain: MyNetwork.net
TEST: Basic (Basc)
Warning: The AAAA record for this DC was not found
TEST: Records registration (RReg)
Network Adapter
[00000006] Broadcom NetXtreme Gigabit Ethernet:
Warning:
Missing AAAA record at DNS server 172.20.3.4:
Server1.MyNetwork.net
Warning:
Missing AAAA record at DNS server 172.20.3.4:
gc._msdcs.MyNetwork.net
Warning:
Missing AAAA record at DNS server 172.20.3.3:
Server1.MyNetwork.net
Warning:
Missing AAAA record at DNS server 172.20.3.3:
gc._msdcs.MyNetwork.net
Warning: Record Registrations not found in some network adapters
Server1 PASS WARN PASS PASS PASS WARN n/a
......................... MyNetwork.net passed test DNS
Do you know if we have to mess with the records now? Also, just to dbl check, after I removed the 3 entries in Advanced and entered my two servers in DNS Mgmt, those address automatically populated in Advanced. Does that seem right? Screenshot below..
***************
C:\Users\admin>dcdiag /test:dns /s:172.20.3.4
Directory Server Diagnosis
Performing initial setup:
[172.20.3.4] Directory Binding Error 87:
The parameter is incorrect.
This may limit some of the tests that can be performed.
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MyNetwork\Server1
Starting test: Connectivity
......................... Server1 passed test Connectivity
Doing primary tests
Testing server: MyNetwork\Server1
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... Server1 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : MyNetwork
Running enterprise tests on : MyNetwork.net
Starting test: DNS
Test results for domain controllers:
DC: Server1.MyNetwork.net
Domain: MyNetwork.net
TEST: Basic (Basc)
Warning: The AAAA record for this DC was not found
TEST: Records registration (RReg)
Network Adapter
[00000006] Broadcom NetXtreme Gigabit Ethernet:
Warning:
Missing AAAA record at DNS server 172.20.3.4:
Server1.MyNetwork.net
Warning:
Missing AAAA record at DNS server 172.20.3.4:
gc._msdcs.MyNetwork.net
Warning:
Missing AAAA record at DNS server 172.20.3.3:
Server1.MyNetwork.net
Warning:
Missing AAAA record at DNS server 172.20.3.3:
gc._msdcs.MyNetwork.net
Warning: Record Registrations not found in some network adapters
Server1 PASS WARN PASS PASS PASS WARN n/a
......................... MyNetwork.net passed test DNS
Do you know if we have to mess with the records now? Also, just to dbl check, after I removed the 3 entries in Advanced and entered my two servers in DNS Mgmt, those address automatically populated in Advanced. Does that seem right? Screenshot below..
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Im sorry I missed the test results...bah!
You are good. The only thing I would do if you're not using IPv6 is stop listening for DNS on IPv6.
You can do that by going to Administrative Tools > DNS, right-click the server, and select Properties > Interfaces Tab. Where it says Listen On: uncheck the IPv6 address checkbox and click Apply, then OK to close the box.
You are good. The only thing I would do if you're not using IPv6 is stop listening for DNS on IPv6.
You can do that by going to Administrative Tools > DNS, right-click the server, and select Properties > Interfaces Tab. Where it says Listen On: uncheck the IPv6 address checkbox and click Apply, then OK to close the box.
ASKER
Hey TMekeel,
Thanks for helping me on that first server. I'm glad to know everything is ok.
So I went to the second server and tried to replicate the settings and ran the same DNS test and got these results. It doesn't look good:
C:\Users\admin>dcdiag /test:dns /s:172.20.3.3
Directory Server Diagnosis
Performing initial setup:
[172.20.3.3] Directory Binding Error 87:
The parameter is incorrect.
This may limit some of the tests that can be performed.
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MyNetwork\Server2
Starting test: Connectivity
......................... Server2 passed test Connectivity
Doing primary tests
Testing server: MyNetwork\Server2
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... Server2 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : MyNetwork
Running enterprise tests on : MyNetwork.net
Starting test: DNS
Test results for domain controllers:
DC: Server2.MyNetwork.net
Domain: MyNetwork.net
TEST: Forwarders/Root hints (Forw)
Error: All forwarders in the forwarder list are invalid.
Error: Both root hints and forwarders are not configured or
broken. Please make sure at least one of them works.
Summary of test results for DNS servers used by the above domain
controllers:
DNS server: 128.63.2.53 (h.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 128.63.2.53
DNS server: 128.8.10.90 (d.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 128.8.10.90
DNS server: 192.112.36.4 (g.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.112.36.4
DNS server: 192.203.230.10 (e.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.203.230.10
DNS server: 192.228.79.201 (b.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.228.79.201
DNS server: 192.33.4.12 (c.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.33.4.12
DNS server: 192.36.148.17 (i.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.36.148.17
DNS server: 192.5.5.241 (f.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.5.5.241
DNS server: 192.58.128.30 (j.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.58.128.30
DNS server: 193.0.14.129 (k.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 193.0.14.129
DNS server: 198.32.64.12 (l.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 198.32.64.12
DNS server: 198.41.0.4 (a.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 198.41.0.4
DNS server: 199.7.91.13 (d.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 199.7.91.13
DNS server: 202.12.27.33 (m.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 202.12.27.33
DNS server: 64.71.0.34 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 64.71.0.34
DNS server: 8.8.8.8 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 8.8.8.8
Summary of DNS test results:
Auth Basc Forw Del Dyn RReg Ext
__________________________
Domain: MyNetwork.net
Server2 PASS PASS FAIL PASS PASS PASS n/a
......................... MyNetwork.net failed test DNS
Sorry for the problem (again) but thanks for the help!
Thanks for helping me on that first server. I'm glad to know everything is ok.
So I went to the second server and tried to replicate the settings and ran the same DNS test and got these results. It doesn't look good:
C:\Users\admin>dcdiag /test:dns /s:172.20.3.3
Directory Server Diagnosis
Performing initial setup:
[172.20.3.3] Directory Binding Error 87:
The parameter is incorrect.
This may limit some of the tests that can be performed.
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MyNetwork\Server2
Starting test: Connectivity
......................... Server2 passed test Connectivity
Doing primary tests
Testing server: MyNetwork\Server2
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... Server2 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : MyNetwork
Running enterprise tests on : MyNetwork.net
Starting test: DNS
Test results for domain controllers:
DC: Server2.MyNetwork.net
Domain: MyNetwork.net
TEST: Forwarders/Root hints (Forw)
Error: All forwarders in the forwarder list are invalid.
Error: Both root hints and forwarders are not configured or
broken. Please make sure at least one of them works.
Summary of test results for DNS servers used by the above domain
controllers:
DNS server: 128.63.2.53 (h.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 128.63.2.53
DNS server: 128.8.10.90 (d.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 128.8.10.90
DNS server: 192.112.36.4 (g.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.112.36.4
DNS server: 192.203.230.10 (e.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.203.230.10
DNS server: 192.228.79.201 (b.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.228.79.201
DNS server: 192.33.4.12 (c.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.33.4.12
DNS server: 192.36.148.17 (i.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.36.148.17
DNS server: 192.5.5.241 (f.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.5.5.241
DNS server: 192.58.128.30 (j.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.58.128.30
DNS server: 193.0.14.129 (k.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 193.0.14.129
DNS server: 198.32.64.12 (l.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 198.32.64.12
DNS server: 198.41.0.4 (a.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 198.41.0.4
DNS server: 199.7.91.13 (d.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 199.7.91.13
DNS server: 202.12.27.33 (m.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 202.12.27.33
DNS server: 64.71.0.34 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 64.71.0.34
DNS server: 8.8.8.8 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 8.8.8.8
Summary of DNS test results:
Auth Basc Forw Del Dyn RReg Ext
__________________________
Domain: MyNetwork.net
Server2 PASS PASS FAIL PASS PASS PASS n/a
......................... MyNetwork.net failed test DNS
Sorry for the problem (again) but thanks for the help!
Does the localhost PTR record exist in your DNS Reverse Lookup?
Something else is incorrect also, could you please attach a screenshot of your Forwarders tab from Administrative Tools > DNS > Server > Right-Click and Select Properties.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
And the interfaces (the NIC on this server is configured statically to 10.0.10.12):
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
hmm, I already tried to have all the DNS Servers look the same (the whole reason why I'm doing this is because I'm setting up a new one, and getting rid of an older one) and took some screenshots for you. These 3 shots are all on server2. What do you think?
Also, I checked the ForestDNS and DomainDNS and the only addresses I see there currently are all the address of my internal DNS servers.
"If you resolve the reverse lookup A record that should probably fix the above failures" --Could you elaborate on this? Or is this what we are simply trying to do..
Also, I checked the ForestDNS and DomainDNS and the only addresses I see there currently are all the address of my internal DNS servers.
"If you resolve the reverse lookup A record that should probably fix the above failures" --Could you elaborate on this? Or is this what we are simply trying to do..
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks for continuing to help me on this. I definitely owe you a beer or 6!
the 192 and 172.30 networks do exist for our office. 172.30 network is a different branch office and the 192 is a completely separate network. I dunno if that helps, but that is what they are there for.
I confirmed there are no public dns records on the NIC, just the 2 internal DNS servers right now.
I disabled the firewall and ran those two commands as suggested and reran the dcdiag test. Unfortunately, I get the same results as posted above.
Would anymore screenshots help? I'd be happy to provide anything else as long as you're happy to help!
the 192 and 172.30 networks do exist for our office. 172.30 network is a different branch office and the 192 is a completely separate network. I dunno if that helps, but that is what they are there for.
I confirmed there are no public dns records on the NIC, just the 2 internal DNS servers right now.
I disabled the firewall and ran those two commands as suggested and reran the dcdiag test. Unfortunately, I get the same results as posted above.
Would anymore screenshots help? I'd be happy to provide anything else as long as you're happy to help!
In your Administrative Tools > DNS, under cached lookups > .(root) is there an A record for 127.0.0.1 for localhost?
ASKER
yes..
Localhost Host (A) 127.0.0.1 static
Localhost Host (A) 127.0.0.1 static
Ok, since we have an existing domain infrastructure....
Can you give an ipconfig /all for the servers with DNS role configured?
Let's get a better picture of all the DNS server's configs.
Can you give an ipconfig /all for the servers with DNS role configured?
Let's get a better picture of all the DNS server's configs.
One other thing, on my lab I have recursion on.
Does your Advanced tab look like this?
Does your Advanced tab look like this?
ASKER
ok, I took a couple of them.
Here is server2 (the new, but failing one) Oh, I also removed the junk from other disconnected NICs
Windows IP Configuration
Host Name . . . . . . . . . . . . : Server2
Primary Dns Suffix . . . . . . . : MyNetwork.net
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : MyNetwork.net
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) I350 Gigabit Network Connection
Physical Address. . . . . . . . . : 00-26-2D-0C-7D-8F
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 172.20.3.3(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 172.20.1.1
DNS Servers . . . . . . . . . . . : 172.20.3.4
172.20.3.3
NetBIOS over Tcpip. . . . . . . . : Enabled
And here is the same ipconfig from Server1:
Windows IP Configuration
Host Name . . . . . . . . . . . . : Server1
Primary Dns Suffix . . . . . . . : MyNetwork.net
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : MyNetwork.net
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
Physical Address. . . . . . . . . : 00-1A-64-20-5C-8F
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 172.20.3.4(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 172.20.1.1
DNS Servers . . . . . . . . . . . : 172.20.3.4
172.20.3.3
NetBIOS over Tcpip. . . . . . . . : Enabled
Here is server2 (the new, but failing one) Oh, I also removed the junk from other disconnected NICs
Windows IP Configuration
Host Name . . . . . . . . . . . . : Server2
Primary Dns Suffix . . . . . . . : MyNetwork.net
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : MyNetwork.net
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) I350 Gigabit Network Connection
Physical Address. . . . . . . . . : 00-26-2D-0C-7D-8F
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 172.20.3.3(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 172.20.1.1
DNS Servers . . . . . . . . . . . : 172.20.3.4
172.20.3.3
NetBIOS over Tcpip. . . . . . . . : Enabled
And here is the same ipconfig from Server1:
Windows IP Configuration
Host Name . . . . . . . . . . . . : Server1
Primary Dns Suffix . . . . . . . : MyNetwork.net
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : MyNetwork.net
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
Physical Address. . . . . . . . . : 00-1A-64-20-5C-8F
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 172.20.3.4(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 172.20.1.1
DNS Servers . . . . . . . . . . . : 172.20.3.4
172.20.3.3
NetBIOS over Tcpip. . . . . . . . : Enabled
ASKER
sadly, I have the same thing you have...
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Honestly, the error you see should not affect anything other then sending out internal loopback information to the internet. It's not a deal breaker by any means.
I'm just unsure of why at the moment, it is not using the records in internal DNS for the loopback and instead sending them out to the root hints.
I'm just unsure of why at the moment, it is not using the records in internal DNS for the loopback and instead sending them out to the root hints.
ASKER
wow..well, as long as its not hurting anything, I guess we can live with it for now.
If you wanna dig into this more, I can send you screenshots of my DNS tables, if that helps.
Let me know, as I know I have already taken up much of your time!
If you wanna dig into this more, I can send you screenshots of my DNS tables, if that helps.
Let me know, as I know I have already taken up much of your time!
No worries. I'm very curious as usually that error is due to not having the A record and reverse PTR records associated, which you do have.
Try restarting the servers and see if the issue is resolved.
Failing that, a screenshot of the DNS tree would be helpful, something like the image below.
Feel free to blur your domain names, but not the extensions please (like .local)
Try restarting the servers and see if the issue is resolved.
Failing that, a screenshot of the DNS tree would be helpful, something like the image below.
Feel free to blur your domain names, but not the extensions please (like .local)
ASKER
Heres a shot of my tree. Let me know if you need anything deeper or anything in the right side panel.
Thanks again!
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
I have a feeling that since you are using .net rather than an internal suffix, that is the main reason you are getting the errors. Just need to find out where, so that we can point them to your internal servers in order to avoid the external lookup.
ASKER
I checked the name servers, and there are 4 servers listed. But that sounds right. I have 2 in my head office, and another one in my 172.30 network (branch office). The 4th server listed is my new server (which is labeled as Server2), which I am assigning DC roles (with DHCP and DNS) to.
When this new server is done, the plan is to repurpose one of my other 2 servers in my head office to something else.
When this new server is done, the plan is to repurpose one of my other 2 servers in my head office to something else.
Can you check the other DNS servers and verify there are either no forwarders or valid forwarders set on them?
ASKER
Here are the results from the dcdiag test on server 3 (in my 172.30 network)
C:\Users\admin>dcdiag /test:dns /s:172.30.1.2
Directory Server Diagnosis
Performing initial setup:
[172.30.1.2] Directory Binding Error 87:
The parameter is incorrect.
This may limit some of the tests that can be performed.
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MyNetwork\server3
Starting test: Connectivity
......................... server3 passed test Connectivity
Doing primary tests
Testing server: MyNetwork\server3
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... server3 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : MyNetwork
Running enterprise tests on : MyNetwork.net
Starting test: DNS
......................... MyNetwork.net passed test DNS
C:\Users\admin>dcdiag /test:dns /s:172.30.1.2
Directory Server Diagnosis
Performing initial setup:
[172.30.1.2] Directory Binding Error 87:
The parameter is incorrect.
This may limit some of the tests that can be performed.
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MyNetwork\server3
Starting test: Connectivity
......................... server3 passed test Connectivity
Doing primary tests
Testing server: MyNetwork\server3
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... server3 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : MyNetwork
Running enterprise tests on : MyNetwork.net
Starting test: DNS
......................... MyNetwork.net passed test DNS
Can you remove the 67.x forwarder from the server2 and make it the same as server1?
Then test again. Thanks.
Also, what does (from a cmd prompt on server2) nslookup localhost return?
Then test again. Thanks.
Also, what does (from a cmd prompt on server2) nslookup localhost return?
ASKER
Sorry, where did you see the 67.x forwarder? I can't seem to find anything like that..
Heres my nslookup results:
C:\Users\admin>nslookup localhost
Server: server2.mynetwork.net
Address: 172.20.3.3
Name: localhost.mynetwork.net
Address: 127.0.0.1
Thanks again!
Heres my nslookup results:
C:\Users\admin>nslookup localhost
Server: server2.mynetwork.net
Address: 172.20.3.3
Name: localhost.mynetwork.net
Address: 127.0.0.1
Thanks again!
Your screenshot of ID: 39170245 above shows it as one of the forwarders. I missed it too, but it's there above google.
I think it's server2, 172.20.3.3...It's the grouped screenshot with the listener tab, dns tree and the forwarders tab.
I think it's server2, 172.20.3.3...It's the grouped screenshot with the listener tab, dns tree and the forwarders tab.
My fault, it's 64.x.x.x
Man, I need glasses or a better memory. I can probably only fix one of those problems...
Man, I need glasses or a better memory. I can probably only fix one of those problems...
ASKER
oh i see that now. Thanks for pointing that out...
That 64.71.0.34 is actually the dns server from our ISP, but I removed it anyways and did a retest. Here are my results:
C:\Users\admin>dcdiag /test:dns /s:172.20.3.3
Directory Server Diagnosis
Performing initial setup:
[172.20.3.3] Directory Binding Error 87:
The parameter is incorrect.
This may limit some of the tests that can be performed.
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MyNetwork\server2
Starting test: Connectivity
......................... server2 passed test Connectivity
Doing primary tests
Testing server: MyNetwork\server2
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... server2 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : MyNetwork
Running enterprise tests on : MyNetwork.net
Starting test: DNS
Test results for domain controllers:
DC: server2.MyNetwork.net
Domain: MyNetwork.net
TEST: Forwarders/Root hints (Forw)
Error: All forwarders in the forwarder list are invalid.
Error: Both root hints and forwarders are not configured or
broken. Please make sure at least one of them works.
Summary of test results for DNS servers used by the above domain
controllers:
DNS server: 128.63.2.53 (h.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 128.63.2.53
DNS server: 128.8.10.90 (d.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 128.8.10.90
DNS server: 192.112.36.4 (g.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.112.36.4
DNS server: 192.203.230.10 (e.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.203.230.10
DNS server: 192.228.79.201 (b.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.228.79.201
DNS server: 192.33.4.12 (c.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.33.4.12
DNS server: 192.36.148.17 (i.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.36.148.17
DNS server: 192.5.5.241 (f.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.5.5.241
DNS server: 192.58.128.30 (j.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.58.128.30
DNS server: 193.0.14.129 (k.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 193.0.14.129
DNS server: 198.32.64.12 (l.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 198.32.64.12
DNS server: 198.41.0.4 (a.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 198.41.0.4
DNS server: 199.7.91.13 (d.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 199.7.91.13
DNS server: 202.12.27.33 (m.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 202.12.27.33
DNS server: 8.8.8.8 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 8.8.8.8
Summary of DNS test results:
Auth Basc Forw Del Dyn RReg Ext
__________________________
Domain: MyNetwork.net
server2 PASS PASS FAIL PASS PASS PASS n/a
......................... MyNetwork.net failed test DNS
Does that change anything?
That 64.71.0.34 is actually the dns server from our ISP, but I removed it anyways and did a retest. Here are my results:
C:\Users\admin>dcdiag /test:dns /s:172.20.3.3
Directory Server Diagnosis
Performing initial setup:
[172.20.3.3] Directory Binding Error 87:
The parameter is incorrect.
This may limit some of the tests that can be performed.
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MyNetwork\server2
Starting test: Connectivity
......................... server2 passed test Connectivity
Doing primary tests
Testing server: MyNetwork\server2
Starting test: DNS
DNS Tests are running and not hung. Please wait a few minutes...
......................... server2 passed test DNS
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : MyNetwork
Running enterprise tests on : MyNetwork.net
Starting test: DNS
Test results for domain controllers:
DC: server2.MyNetwork.net
Domain: MyNetwork.net
TEST: Forwarders/Root hints (Forw)
Error: All forwarders in the forwarder list are invalid.
Error: Both root hints and forwarders are not configured or
broken. Please make sure at least one of them works.
Summary of test results for DNS servers used by the above domain
controllers:
DNS server: 128.63.2.53 (h.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 128.63.2.53
DNS server: 128.8.10.90 (d.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 128.8.10.90
DNS server: 192.112.36.4 (g.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.112.36.4
DNS server: 192.203.230.10 (e.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.203.230.10
DNS server: 192.228.79.201 (b.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.228.79.201
DNS server: 192.33.4.12 (c.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.33.4.12
DNS server: 192.36.148.17 (i.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.36.148.17
DNS server: 192.5.5.241 (f.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.5.5.241
DNS server: 192.58.128.30 (j.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 192.58.128.30
DNS server: 193.0.14.129 (k.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 193.0.14.129
DNS server: 198.32.64.12 (l.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 198.32.64.12
DNS server: 198.41.0.4 (a.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 198.41.0.4
DNS server: 199.7.91.13 (d.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 199.7.91.13
DNS server: 202.12.27.33 (m.root-servers.net.)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 202.12.27.33
DNS server: 8.8.8.8 (<name unavailable>)
1 test failure on this DNS server
PTR record query for the 1.0.0.127.in-addr.arpa. failed on the DNS server 8.8.8.8
Summary of DNS test results:
Auth Basc Forw Del Dyn RReg Ext
__________________________
Domain: MyNetwork.net
server2 PASS PASS FAIL PASS PASS PASS n/a
......................... MyNetwork.net failed test DNS
Does that change anything?
Can you run dnscmd /enumzones from a cmd prompt on server2 please?
ASKER
Here you go!
Enumerated zone list:
Zone count = 7
Zone name Type Storage Properties
. Cache AD-Domain
1.168.192.in-addr.arpa Primary AD-Legacy Secure Rev Aging
172.in-addr.arpa Primary AD-Domain Secure Rev
20.172.in-addr.arpa Primary AD-Legacy Secure Rev Aging
30.172.in-addr.arpa Primary AD-Domain Secure Rev
MyNetwork.net Primary AD-Legacy Secure Aging
TrustAnchors Primary AD-Forest
Command completed successfully.
What does this command tell you anyways?
Enumerated zone list:
Zone count = 7
Zone name Type Storage Properties
. Cache AD-Domain
1.168.192.in-addr.arpa Primary AD-Legacy Secure Rev Aging
172.in-addr.arpa Primary AD-Domain Secure Rev
20.172.in-addr.arpa Primary AD-Legacy Secure Rev Aging
30.172.in-addr.arpa Primary AD-Domain Secure Rev
MyNetwork.net Primary AD-Legacy Secure Aging
TrustAnchors Primary AD-Forest
Command completed successfully.
What does this command tell you anyways?
ASKER
Here are slightly different results from Server1:
Enumerated zone list:
Zone count = 6
Zone name Type Storage Properties
. Cache AD-Domain
1.168.192.in-addr.arpa Primary AD-Legacy Secure Rev Aging
172.in-addr.arpa Primary AD-Domain Secure Rev
20.172.in-addr.arpa Primary AD-Legacy Secure Rev Aging
30.172.in-addr.arpa Primary AD-Domain Secure Rev
MyNetwork.net Primary AD-Legacy Secure Aging
Command completed successfully.
Enumerated zone list:
Zone count = 6
Zone name Type Storage Properties
. Cache AD-Domain
1.168.192.in-addr.arpa Primary AD-Legacy Secure Rev Aging
172.in-addr.arpa Primary AD-Domain Secure Rev
20.172.in-addr.arpa Primary AD-Legacy Secure Rev Aging
30.172.in-addr.arpa Primary AD-Domain Secure Rev
MyNetwork.net Primary AD-Legacy Secure Aging
Command completed successfully.
It shows your zones, basically and how the records are set.
No trustanchors on the server1?
Hmmm.
Ok, are you seeing any errors in the event logs related to DNS on either server?
I never asked, but I assume nslookups for internal servers like so:
nslookup server1
work correctly, as well as nslookup for external sites like amazon.com work too?
I still feel as though this issue is safe to ignore, but I want to be sure.
Can you also check for duplicate zones per this article?
Thanks.
http://msmvps.com/blogs/acefekay/archive/2009/09/02/using-adsi-edit-to-resolve-conflicting-or-duplicate-ad-integrated-dns-zones.aspx
No trustanchors on the server1?
Hmmm.
Ok, are you seeing any errors in the event logs related to DNS on either server?
I never asked, but I assume nslookups for internal servers like so:
nslookup server1
work correctly, as well as nslookup for external sites like amazon.com work too?
I still feel as though this issue is safe to ignore, but I want to be sure.
Can you also check for duplicate zones per this article?
Thanks.
http://msmvps.com/blogs/acefekay/archive/2009/09/02/using-adsi-edit-to-resolve-conflicting-or-duplicate-ad-integrated-dns-zones.aspx
ASKER
Server1 is running Windows server 2008, where Server2 is running 2008 R2. Does that make a difference?
In 2008 non-R2, there is no Trust Anchor tab in the server properties under DNS Mgmt. But there is a Trust Anchor tab in the R2 version.
I don't know if any of that matters, but I thought I should point that out to you..
Anyways, here are my nslookup results:
H:\>nslookup Server1
Server: Server3.MyNetwork.net
Address: 172.20.3.5
Name: Server1.MyNetwork.net
Address: 172.20.3.4
H:\>nslookup www.amazon.com
Server: Server3.MyNetwork.net
Address: 172.20.3.5
Non-authoritative answer:
Name: www.amazon.com
Address: 72.21.194.212
Also, during this project, I'm starting to get errors from some of my Windows users trying to access network drives. It seems that Windows is trying to reauthenticate the user, or it says there is any unexpected error when trying to access the share. Does that help?
Thanks so much again for working with me on this....
In 2008 non-R2, there is no Trust Anchor tab in the server properties under DNS Mgmt. But there is a Trust Anchor tab in the R2 version.
I don't know if any of that matters, but I thought I should point that out to you..
Anyways, here are my nslookup results:
H:\>nslookup Server1
Server: Server3.MyNetwork.net
Address: 172.20.3.5
Name: Server1.MyNetwork.net
Address: 172.20.3.4
H:\>nslookup www.amazon.com
Server: Server3.MyNetwork.net
Address: 172.20.3.5
Non-authoritative answer:
Name: www.amazon.com
Address: 72.21.194.212
Also, during this project, I'm starting to get errors from some of my Windows users trying to access network drives. It seems that Windows is trying to reauthenticate the user, or it says there is any unexpected error when trying to access the share. Does that help?
Thanks so much again for working with me on this....
ASKER
"Basically, in a nutshell, the local DNS queries for your zone mynetwork.net should be resolved for your internal network by the server. If the name isnt in DNS for that zone, the server uses the forwarder to find the dns entries out of that zone. " <<--this is exactly what my intention is!
I have no need/intention of hosting public DNS. I guess this is set wrong.
In response to your suggestions, I'm a bit confused. Server1 (which is the first set of test results in my OP) is already set to 172.20.3.4. I went into my DNS settings and it is fwding to itself first, and then the 64.71.0.34 address (Please see embedded picture). Is that what I mean?
I'm guessing you are suggesting to do something else with my A records, is that right?
thanks again for the input! Please reply only when you have the time! thanks!