Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

DNS Conditional Forwarder refusing requests for _mcdcs.remote.domain

I have a local AD server with DNS installed called (adserver.mydomain.local) To allow trust relationships with other domains we have configured a number of conditional forwards to remote AD servers. All of these work fine except for one: it forwards most requests correctly but when it receives a request for ._msdcs.remote.domain it rejects it without trying to contact the remote server, even after clearing the DNS servers cache. This problem started after the AD servers at the remote location were replaced. This DNS issue causes lookups for the _ldap._tcp.dc._msdcs.remote.domain SRV record to fail, which prevents the AD trust from working correctly as the local servers can find a login server for remote.domain.

If I perform an nslookup directly to the remote.domain DNS servers it works correctly, this problem is only seen when the request is passed through the conditional forwarder. This affects both a windows 2003 and a windows 2008 AD server on the local domain.

The message using nslookup is "adserver.mydomain.local can't find _ldap._tcp.dc._msdcs.remote.domain: Query refused"

Looking at a network trace the DNS server is returning a "refused" response.

Why would the DNs server do this for any addess under _msdcs.remote.domain, and how can I fix it? The conditional forwarders for all other domains are working correctly, it's only this one that is causeing problems. _msdcs.remote.domain

If I sniff the network traffic it looks like this:

Request:

+ Udp: SrcPort = 59685, DstPort = DNS(53), Length = 57
- Dns: QueryId = 0x9, QUERY (Standard query), Query  for _ldap._tcp.dc._msdcs.remote.domain of type SRV on class Internet
    QueryIdentifier: 9 (0x9)
  - Flags:  Query, Opcode - QUERY (Standard query), RD, Rcode - Success
     QR:                (0...............) Query
     Opcode:            (.0000...........) QUERY (Standard query) 0
     AA:                (.....0..........) Not authoritative
     TC:                (......0.........) Not truncated
     RD:                (.......1........) Recursion desired
     RA:                (........0.......) Recursive query support not available
     Zero:              (.........0......) 0
     AuthenticatedData: (..........0.....) Not AuthenticatedData
     CheckingDisabled:  (...........0....) Not CheckingDisabled
     Rcode:             (............0000) Success 0
    QuestionCount: 1 (0x1)
    AnswerCount: 0 (0x0)
    NameServerCount: 0 (0x0)
    AdditionalCount: 0 (0x0)
  - QRecord: _ldap._tcp.dc._msdcs.sctcns.net of type SRV on class Internet
     QuestionName: _ldap._tcp.dc._msdcs.remote.domain
     QuestionType: SRV, Server Selection/NBSTAT, NetBIOS NODE STATUS, 33(0x21)
     QuestionClass: Internet, 1(0x1)

Response:

+ Udp: SrcPort = DNS(53), DstPort = 59685, Length = 57
- Dns: QueryId = 0x9, QUERY (Standard query), Response - Refused 
    QueryIdentifier: 9 (0x9)
  - Flags:  Response, Opcode - QUERY (Standard query), AA, RD, RA, Rcode - Refused
     QR:                (1...............) Response
     Opcode:            (.0000...........) QUERY (Standard query) 0
     AA:                (.....1..........) Is authoritative
     TC:                (......0.........) Not truncated
     RD:                (.......1........) Recursion desired
     RA:                (........1.......) Recursive query support available
     Zero:              (.........0......) 0
     AuthenticatedData: (..........0.....) Not AuthenticatedData
     CheckingDisabled:  (...........0....) Not CheckingDisabled
     Rcode:             (............0101) Refused 5
    QuestionCount: 1 (0x1)
    AnswerCount: 0 (0x0)
    NameServerCount: 0 (0x0)
    AdditionalCount: 0 (0x0)
  - QRecord: _ldap._tcp.dc._msdcs.remote.domaint of type SRV on class Internet
     QuestionName: _ldap._tcp.dc._msdcs.remote.domain
     QuestionType: SRV, Server Selection/NBSTAT, NetBIOS NODE STATUS, 33(0x21)
     QuestionClass: Internet, 1(0x1)
share|improve this question
    
You can get refused if the zone has expired. I.e. secondary zone is expired and you are querying against it. But you claim its a conditional forwarder. Are you saying you do nslookup against adserver.mydomain.local and it refuses. Yet if you do nslookup directly against the DNS server(s) it conditionally forwards to, you get a response? –  maweeras Jul 30 '11 at 0:20

1 Answer 1

Some further questions arise: Is your forwarder a Microsoft DNS server installation or another vendor's DNS server? Do you happen to have a zone named remote.domain on this server? Where did you take your caps? Is the forwarding configuration still correct in regards to destination domain's DNS server addresses?

As a quick & dirty workaround you might consider either doing a zone transfer for remote.domain or configuring a stub zone.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.