Two of my AD controllers (both running DNS service) appear to be having a similar issue. Both are throwing lots of events in the DNS events that look like this:
Event Type: Information Event Source: DNS Event Category: None Event ID: 5504 Date: 5/24/2010 Time: 11:51:38 AM User: N/A Computer: ALPHA Description: The DNS server encountered an invalid domain name in a packet from 220.127.116.11. The packet will be rejected. The event data contains the DNS packet.
That will come with the same event, same time, with a packet from 18.104.22.168 as well. I know this is "Information" not an error, but since it is new and different it bothers me (yes, I fear unexplained change!)
Both machines are running Windows 2003 R2 SP2. The DNS servers are not exposed to the internet.
Both DNS servers are configured to use OpenDNS for Forwarders.
For both servers, this started about a week ago.
Any thoughts on:
1) should I be concerned?
2) how can I stop/fix this?
To keep it interesting, I have a 3rd AD / DNS box. Same domain, different Active Directory site. Same forwarders, yet doesn't have this issue.
On a whim, I changed the forwarders on one of the DNS servers to use Google's public DNS (22.214.171.124 and 126.96.36.199) instead of OpenDNS. Didn't change anything, so I think I can eliminate the forwarders as the cause.