Environment:
Active Directory domain with a single domain controller (Windows Server 2003 R2 Standard x64 Edition - Service Pack 2) which is also the DNS
Windows XP Service Pack 3 clients. The client computers have ONLY our internal DNS server as their DNS address.
Our users have reported that occasionally they cannot visit Southwest Airlines website www.southwest.com.
After a few days of trying we were able to reproduce the problem in a test user's login.
When attempting to access the site in Firefox, the status bar says, "Looking up www.southwest.com" and after a few moments Firefox displays:
Address Not Found
Firefox can't find the server at www.southwest.com
Similar results in Internet Explorer
We tried restarting the browser and the computer, but we still cannot access the site. Other websites we tested work normally.
We tried accessing the website from another computer and got the same results.
nslookup reveals the following:
C:\Documents and Settings\TestQ>nslookup www.teamdesk.net
Server: server.domain.local
Address: 172.21.31.206
Name: www.teamdesk.net
Address: 208.100.33.78
C:\Documents and Settings\TestQ>nslookup www.southwest.com
Server: server.domain.local
Address: 172.21.31.206
DNS request timed out.
timeout was 2 seconds.
*** Request to server.domain.local timed-out
C:\Documents and Settings\TestQ>nslookup
Default Server: server.domain.local
Address: 172.21.31.206
> www.southwest.com
Server: server.domain.local
Address: 172.21.31.206
DNS request timed out.
timeout was 2 seconds.
*** Request to server.domain.local timed-out
> set d2
> www.southwest.com
Server: server.domain.local
Address: 172.21.31.206
------------
SendRequest(), len 51
HEADER:
opcode = QUERY, id = 4, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.southwest.com.domain.local, type = A, class = IN
------------
------------
Got answer (119 bytes):
HEADER:
opcode = QUERY, id = 4, rcode = NXDOMAIN
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1, additional = 0
QUESTIONS:
www.southwest.com.domain.local, type = A, class = IN
AUTHORITY RECORDS:
-> domain.local
type = SOA, class = IN, dlen = 41
ttl = 3600 (1 hour)
primary name server = server.domain.local
responsible mail addr = hostmaster
serial = 2064
refresh = 900 (15 mins)
retry = 600 (10 mins)
expire = 86400 (1 day)
default TTL = 3600 (1 hour)
------------
------------
SendRequest(), len 35
HEADER:
opcode = QUERY, id = 5, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.southwest.com, type = A, class = IN
------------
DNS request timed out.
timeout was 2 seconds.
timeout (2 secs)
SendRequest failed
*** Request to server.domain.local timed-out
> www.google.com
Server: server.domain.local
Address: 172.21.31.206
------------
SendRequest(), len 48
HEADER:
opcode = QUERY, id = 6, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.google.com.domain.local, type = A, class = IN
------------
------------
Got answer (116 bytes):
HEADER:
opcode = QUERY, id = 6, rcode = NXDOMAIN
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1, additional = 0
QUESTIONS:
www.google.com.domain.local, type = A, class = IN
AUTHORITY RECORDS:
-> domain.local
type = SOA, class = IN, dlen = 41
ttl = 3600 (1 hour)
primary name server = server.domain.local
responsible mail addr = hostmaster
serial = 2064
refresh = 900 (15 mins)
retry = 600 (10 mins)
expire = 86400 (1 day)
default TTL = 3600 (1 hour)
------------
------------
SendRequest(), len 32
HEADER:
opcode = QUERY, id = 7, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0
QUESTIONS:
www.google.com, type = A, class = IN
------------
------------
Got answer (132 bytes):
HEADER:
opcode = QUERY, id = 7, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 6, authority records = 0, additional = 0
QUESTIONS:
www.google.com, type = A, class = IN
ANSWERS:
-> www.google.com
type = CNAME, class = IN, dlen = 8
canonical name = www.l.google.com
ttl = 69859 (19 hours 24 mins 19 secs)
-> www.l.google.com
type = A, class = IN, dlen = 4
internet address = 74.125.239.19
ttl = 300 (5 mins)
-> www.l.google.com
type = A, class = IN, dlen = 4
internet address = 74.125.239.20
ttl = 300 (5 mins)
-> www.l.google.com
type = A, class = IN, dlen = 4
internet address = 74.125.239.18
ttl = 300 (5 mins)
-> www.l.google.com
type = A, class = IN, dlen = 4
internet address = 74.125.239.17
ttl = 300 (5 mins)
-> www.l.google.com
type = A, class = IN, dlen = 4
internet address = 74.125.239.16
ttl = 300 (5 mins)
------------
Non-authoritative answer:
Name: www.l.google.com
Addresses: 74.125.239.19, 74.125.239.20, 74.125.239.18, 74.125.239.17
74.125.239.16
Aliases: www.google.com
How do we further diagnose and resolve this problem?
EDIT
I work with Brad. Thanks for your help so far.
1) The DNS server acts as the resolver. There is no forward lookup other than the root servers via root hints.
2) Under the error state (i.e., when the southwest.com lookups are timing out), nslookup southwest.com ns-1.southwest.com times out looking up the ns-1.southwest.com server. Same thing with ns-2.southwest.com.
3) Under the error state, nslookup southwest.com 12.5.136.190 and nslookup southwest.com 63.169.44.190 (i.e., against the IP addresses of ns-1 and ns-2.southwest.com) both work, returning southwest.com's IP addresses.
4) Under the error state, the cache is unchanged from when things are working normally. That is, dnsmgmt\cached lookups.(root)\com\southwest always shows the following (including the A record for ns-2, which fails (see #2 above)).
Name Type Data
---- ---- ----
(same as parent folder) Name Server (NS) ns-1.southwest.com
(same as parent folder) Name Server (NS) ns-2.southwest.com
(same as parent folder) Host (A) 208.94.152.100
(same as parent folder) Host (A) 208.94.153.100
ns-2 Host (A) 63.169.44.190
I suspect we're overlooking something obvious ...
EDIT
(Sorry for the delay. I posted this over 8 hours ago but it never appeared.)
Under the error state,
5) nslookup southwest.com against all *.gtld-servers.net servers succeeded
... QUESTIONS:
southwest.com, type = A, class = IN
AUTHORITY RECORDS:
-> southwest.com
type = NS, class = IN, dlen = 7
nameserver = ns-1.southwest.com
ttl = 172800 (2 days)
-> southwest.com
type = NS, class = IN, dlen = 7
nameserver = ns-2.southwest.com
ttl = 172800 (2 days)
ADDITIONAL RECORDS:
-> ns-1.southwest.com
type = A, class = IN, dlen = 4
internet address = 12.5.136.190
ttl = 172800 (2 days)
-> ns-2.southwest.com
type = A, class = IN, dlen = 4
internet address = 63.169.44.190
ttl = 172800 (2 days)
------------
Name: southwest.com
Served by:
- ns-1.southwest.com
12.5.136.190
southwest.com
- ns-2.southwest.com
63.169.44.190
southwest.com
6) nslookup southwest.com 208.67.222.222 (OpenDNS) succeeded
7) Clearing the cache fixed the problem, but it just returns later.
8) After clearing the cache and doing nslookup southwest.com (which succeeds), the cache now has ns-1's A record (it didn't under the error state, see #4 above)
Name Type Data
---- ---- ----
(same as parent folder) Name Server (NS) ns-1.southwest.com
(same as parent folder) Name Server (NS) ns-2.southwest.com
(same as parent folder) Host (A) 208.94.153.100
(same as parent folder) Host (A) 208.94.152.100
ns-1 Host (A) 12.5.136.190
ns-2 Host (A) 63.169.44.190
9) Note that the DNS server only forwards to the root servers. Can you think of any reason that should cause this problem?
