Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am unclear on how the Windows DNS server is supposed to used additional records (or additional section).

From a packet sniff I am noticing the following:

query root server for
response: gltd ns servers for .com (with additional records)
query GLTD server for
response: (and ns2) for (with additional records)
query root server for
response: gltd ns servers for .net (with additional records)

What I am confused on is why is the windows DNS server not using the IP in the Additional Records for - but it goes and queries root servers? (not caching is disabled)

share|improve this question

This happens for security reasons - to prevent DNS spoofing (cache poisoning).

Your DNS server knows that these GTLD servers are authoritative for .com because it just got the referral for this from the root. Therefore it accepts the two NS-records as their record names are under .com.

However it does not know if these GTLD servers are also authoritative for .net or not. Therefore it cannot trust the additional records with record names under .net (they could be cached poison), and it restarts at the root to be sure.

share|improve this answer
up vote 1 down vote accepted

I believe I found the setting that controls this feature:

"Secure Cache Against Pollution setting" is one of the settings enabled.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.