Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to figure out how one goes about setting up DNS in a setup like at my work. We have:

  1. A "business" DSL line that is just a home DSL line with a dedicated IP address
  2. A Sonicwall router (NAT/VPN) appliance connected to the DSL modem (
  3. A Windows Server 2008 R2 box running Active Directory and DNS (

Each PC on our network is configured to use as DNS, using manually-configured IP addresses. DHCP is enabled on the Sonicwall for VPN clients, not used for our workstations.

The server's NIC is configured to use:

The second and third entries are our ISP's DNS servers.

The problem is that while everything works, DNS resolution is absurdly slow for internet sites. Using GRC's DNSBench.exe, uncached requests to are taking 3849 ms! Connecting to our ISP's DNS servers directly takes about 100 ms for the same uncached requests.

Thanks for any help - I really don't know what I'm doing here. Hah.

share|improve this question
On the server, in DNS management, right-click on the server and go to properties. In the forwarders tab, what's configured? – Shane Madden Aug 25 '11 at 21:45
There are no forwarders configured - the 2008 R2 system is set up the same way our Windows Server 2003 box was (I didn't install that one). Apparently, it was set up wrong for the last 4.5 years! – evilspoons Aug 26 '11 at 14:19
up vote 5 down vote accepted

Drop your ISP's DNS servers out of your client's and your server's config. Once you've done that, add those servers as "forwarders" in the DNS server setup on the 2008R2 box.

With this setup, your clients will send all of their DNS queries to the server, and for queries the server is not authoritative for (basically anything outside your AD domain), it will recursively query your upstream ISP's DNS servers and then return the answer to your clients.

share|improve this answer
@evilspoons: I agree with ErikA. In addition, set the NIC on the server to use the server's ip address instead of the localhost address. You might also consider using the root hints rather than forwarders at your ISP. – joeqwerty Aug 25 '11 at 22:53
I had read about forwarders on Microsoft TechNet but I couldn't get past their indecipherable wording on the article. This gives me something to actually work with. – evilspoons Aug 26 '11 at 14:20
@joeqwerty : What is the difference between using and the server's IP address? Wouldn't using the localhost be identically functional and continue to work if the server's IP changed for whatever reason? – evilspoons Aug 26 '11 at 14:28
@evilspoons: I suppose that there's no functional difference but there used to be a problem with RRAS clients if the DC/DNS server was also a RRAS server and pointed to for DNS so I just got in the habit of using the actual ip address instead of localhost. It's just my preference. – joeqwerty Aug 26 '11 at 15:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.