How to trace DNS forwarding?

Posted on 2014-08-28
Last Modified: 2014-09-04
Hi Experts,
What I have:
2 x internal DNS server (Svr2008R2) - configured to forward queries 2 x external DNS server
2 x external DNS server (RHEL6.4 - bind) - configured to forward queries to Google DNS (,
Clients computers are configured to lookup names using 2 x internal DNS servers.

What I want to know is how to trace the DNS forwarding queries when a user do a DNS lookup on client computer. Technically, I know that query will be sent to internal DNS servers, then internal DNS server will forward the query to external DNS server, then external DNS servers will forward the query to Google DNS servers.  
But I need a way to trace DNS forwarding from client perspective.

Thanks in advance,
Question by:netlynker
    LVL 76

    Expert Comment

    use the -debug option to nslookup
    Not you will see a complete trace, though have not seen such a scheme.  Presumably you are working on the premise that by pushing everything to google's DNS, your systems will not face external DNS based attacks.

    Decide which name servers you want querying the push them to the client.
    When you have your own DNS servers performing and collecting the data, they will cache the results, when you forward, the same lookups will continue to be done.

    i.e. you go to www,
    the client sends a lookup for to your INternal DNS
    Internal DNS forwars the request to your bind external DNS
    your external Bind forwards to google DNS
    google DNS collects and caches the data
    google DNS responds back to bind external DNS
    bind external DNS responds back to internal DNS
    internal DNS responds back to the client that caches the result

    now if another system on your network goes to the above flow takes place again.
    If one of your managed DNS servers actually performed the query rather than forward, the second client system would have received the cached response.
    LVL 34

    Assisted Solution

    U can install and run network monitor on client machine and internal dns servers to find out dns traffic
    U can filter dns traffic
    However this will not give you traffic that is flown between external dns (Bind) servers and dns servers out on the internet
    LVL 35

    Accepted Solution

    Since the protocol doesn't include information about forwarding in any sense, you're out of luck. To trace it, you need to have network monitoring on EVERY single node the DNS request passes through. That means about 4 Wireshark installs (2 x Windows, 2 x RHEL). The matching, has to be done by you as well (on the second step (RHEL), you already don't know which is the original client requesting it, you have to use the Windows capture to trace it back.
    LVL 61

    Expert Comment

    All DNS servers know where to send queries. They have some configuratio you know.
    If windows server has DNS zone it answer's its records/nxdomains, if not it queries "external" dns servers
    I dont know why you use google as a forwarder when BIND is completely capable of doing full resolution. Google is for desktop users who dont have DNS server.

    Author Closing Comment

    Hi All,

    Yes, using wireshark/tcpdump on DNS servers seem to be the only solution. Thank all for your help.


    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Join & Write a Comment

    There have been a lot of times when we have seen the need to enter a large number of DNS entries in a forward lookup zone. The standard procedure would be to launch the DNS Manager console, create the Zone and start adding new hosts using the New…
    You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
    This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
    To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now