Microsoft 2003 DNS sometimes cant query for some A pointers when their TTL expires

Question

Warning Long question :)

We have a win 2003 server with a DNS server, every now and then it cant provide us with some A pointers for a specific domain.

I have a small script running which asks for SOA,NS and A records for the domain in question and sometimes when the TTL expires the DNS fails to get the A records again, a Clear Cache fixes the problem..

Have a look

Here it worked when the TTL expired

Thu Apr 29 15:24:20 METDST 2010
dig basefarm.net soa
    basefarm.net.           64908   IN      SOA     ns01.osl.basefarm.net. hostmaster.basefarm.net. 2010042613 86400 3600 2419200 600
    ns01.osl.basefarm.net.  299     IN      A       81.93.160.4
dig basefarm.net ns
    basefarm.net.           64908   IN      NS      ns01.sth.basefarm.net.
    basefarm.net.           64908   IN      NS      ns01.osl.basefarm.net.
    ns01.sth.basefarm.net.  299     IN      A       80.76.149.76
    ns01.osl.basefarm.net.  299     IN      A       81.93.160.4
dig ns01.sth.basefarm.net a
    ns01.sth.basefarm.net.  299     IN      A       80.76.149.76

The TTL expired for ns01.sth.basefarm.net and ns01.osl.basefarm.net but the DNS managed to get the new values (TTL 3600)

Thu Apr 29 15:29:20 METDST 2010
dig basefarm.net soa
    basefarm.net.           64608   IN      SOA     ns01.osl.basefarm.net. hostmaster.basefarm.net. 2010042613 86400 3600 2419200 600
    ns01.osl.basefarm.net.  3600    IN      A       81.93.160.4
dig basefarm.net ns
    basefarm.net.           64608   IN      NS      ns01.sth.basefarm.net.
    basefarm.net.           64608   IN      NS      ns01.osl.basefarm.net.
    ns01.sth.basefarm.net.  3600    IN      A       80.76.149.76
    ns01.osl.basefarm.net.  3600    IN      A       81.93.160.4
dig ns01.sth.basefarm.net a
    ns01.sth.basefarm.net.  3600    IN      A       80.76.149.76

But then another time it fails, and we need to clear the dns cache for it to start working again...

Thu Apr 29 17:24:23 METDST 2010
dig basefarm.net soa
    basefarm.net.           57705   IN      SOA     ns01.osl.basefarm.net. hostmaster.basefarm.net. 2010042613 86400 3600 2419200 600
    ns01.osl.basefarm.net.  299     IN      A       81.93.160.4
dig basefarm.net ns
    basefarm.net.           57705   IN      NS      ns01.sth.basefarm.net.
    basefarm.net.           57705   IN      NS      ns01.osl.basefarm.net.
    ns01.sth.basefarm.net.  299     IN      A       80.76.149.76
    ns01.osl.basefarm.net.  299     IN      A       81.93.160.4
dig ns01.sth.basefarm.net a
    ns01.sth.basefarm.net.  299     IN      A       80.76.149.76

The TTL expires but the DNS cant get the ip addresses for ns01.sth.basefarm.net and ns01.osl.basefarm.net

Thu Apr 29 17:29:23 METDST 2010
dig basefarm.net soa
    basefarm.net.           57405   IN      SOA     ns01.osl.basefarm.net. hostmaster.basefarm.net. 2010042613 86400 3600 2419200 600
    ns01.osl.basefarm.net.  3600    IN      A       81.93.160.4
dig basefarm.net ns
    basefarm.net.           57405   IN      NS      ns01.sth.basefarm.net.
    basefarm.net.           57405   IN      NS      ns01.osl.basefarm.net.
dig ns01.sth.basefarm.net a
    Lookup failed

I'm really lost on this one and have tried asking Google but to no avail..

Answer 1

I seem to recall that there's a bug in MS DNS when the NS records and A records don't have the same TTL, but I can't find the details of it at the moment.

For now I suggest the easiest likely workaround is to change the NS and A TTLs on your server to match those published in the .net parent zone - i.e. 172800s.

Answer 2

Thanks for a point in the right direction, I think I found the solution on m$ technet

http://support.microsoft.com/kb/938863

Will have to try it tomorow..

Answer 3

Here is a kooky thing that we ran into, dunno if applies. Vista/Win7 makes IPv6 queries for stuff at the same time as IPv4. When MS-DNS forwards them to another DNS, if that DNS is old, it may respond "not found" to the IPv6 request, which is wrong, and causes MS-DNS to mark the IPv4 record as not found as well until you clear cache or TTL expires.