Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Environment:

  • Active Directory domain with a single domain controller (Windows Server 2003 R2 Standard x64 Edition - Service Pack 2) which is also the DNS

  • Windows XP Service Pack 3 clients. The client computers have ONLY our internal DNS server as their DNS address.

Our users have reported that occasionally they cannot visit Southwest Airlines website www.southwest.com.

After a few days of trying we were able to reproduce the problem in a test user's login.

When attempting to access the site in Firefox, the status bar says, "Looking up www.southwest.com" and after a few moments Firefox displays:

Address Not Found

Firefox can't find the server at www.southwest.com

Similar results in Internet Explorer

We tried restarting the browser and the computer, but we still cannot access the site. Other websites we tested work normally.

We tried accessing the website from another computer and got the same results.

nslookup reveals the following:

C:\Documents and Settings\TestQ>nslookup www.teamdesk.net
Server:  server.domain.local
Address:  172.21.31.206

Name:    www.teamdesk.net
Address:  208.100.33.78


C:\Documents and Settings\TestQ>nslookup www.southwest.com
Server:  server.domain.local
Address:  172.21.31.206

DNS request timed out.
    timeout was 2 seconds.
*** Request to server.domain.local timed-out


C:\Documents and Settings\TestQ>nslookup
Default Server:  server.domain.local
Address:  172.21.31.206

> www.southwest.com
Server:  server.domain.local
Address:  172.21.31.206

DNS request timed out.
    timeout was 2 seconds.
*** Request to server.domain.local timed-out

> set d2
> www.southwest.com
Server:  server.domain.local
Address:  172.21.31.206

------------
SendRequest(), len 51
    HEADER:
        opcode = QUERY, id = 4, rcode = NOERROR
        header flags:  query, want recursion
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.southwest.com.domain.local, type = A, class = IN

------------
------------
Got answer (119 bytes):
    HEADER:
        opcode = QUERY, id = 4, rcode = NXDOMAIN
        header flags:  response, auth. answer, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        www.southwest.com.domain.local, type = A, class = IN
    AUTHORITY RECORDS:
    ->  domain.local
        type = SOA, class = IN, dlen = 41
        ttl = 3600 (1 hour)
        primary name server = server.domain.local
        responsible mail addr = hostmaster
        serial  = 2064
        refresh = 900 (15 mins)
        retry   = 600 (10 mins)
        expire  = 86400 (1 day)
        default TTL = 3600 (1 hour)

------------
------------
SendRequest(), len 35
    HEADER:
        opcode = QUERY, id = 5, rcode = NOERROR
        header flags:  query, want recursion
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.southwest.com, type = A, class = IN

------------
DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
SendRequest failed
*** Request to server.domain.local timed-out


> www.google.com
Server:  server.domain.local
Address:  172.21.31.206

------------
SendRequest(), len 48
    HEADER:
        opcode = QUERY, id = 6, rcode = NOERROR
        header flags:  query, want recursion
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.google.com.domain.local, type = A, class = IN

------------
------------
Got answer (116 bytes):
    HEADER:
        opcode = QUERY, id = 6, rcode = NXDOMAIN
        header flags:  response, auth. answer, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        www.google.com.domain.local, type = A, class = IN
    AUTHORITY RECORDS:
    ->  domain.local
        type = SOA, class = IN, dlen = 41
        ttl = 3600 (1 hour)
        primary name server = server.domain.local
        responsible mail addr = hostmaster
        serial  = 2064
        refresh = 900 (15 mins)
        retry   = 600 (10 mins)
        expire  = 86400 (1 day)
        default TTL = 3600 (1 hour)

------------
------------
SendRequest(), len 32
    HEADER:
        opcode = QUERY, id = 7, rcode = NOERROR
        header flags:  query, want recursion
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        www.google.com, type = A, class = IN

------------
------------
Got answer (132 bytes):
    HEADER:
        opcode = QUERY, id = 7, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 6,  authority records = 0,  additional = 0

    QUESTIONS:
        www.google.com, type = A, class = IN
    ANSWERS:
    ->  www.google.com
        type = CNAME, class = IN, dlen = 8
        canonical name = www.l.google.com
        ttl = 69859 (19 hours 24 mins 19 secs)
    ->  www.l.google.com
        type = A, class = IN, dlen = 4
        internet address = 74.125.239.19
        ttl = 300 (5 mins)
    ->  www.l.google.com
        type = A, class = IN, dlen = 4
        internet address = 74.125.239.20
        ttl = 300 (5 mins)
    ->  www.l.google.com
        type = A, class = IN, dlen = 4
        internet address = 74.125.239.18
        ttl = 300 (5 mins)
    ->  www.l.google.com
        type = A, class = IN, dlen = 4
        internet address = 74.125.239.17
        ttl = 300 (5 mins)
    ->  www.l.google.com
        type = A, class = IN, dlen = 4
        internet address = 74.125.239.16
        ttl = 300 (5 mins)

------------
Non-authoritative answer:
Name:    www.l.google.com
Addresses:  74.125.239.19, 74.125.239.20, 74.125.239.18, 74.125.239.17
            74.125.239.16
Aliases:  www.google.com

How do we further diagnose and resolve this problem?

EDIT

I work with Brad. Thanks for your help so far.

1) The DNS server acts as the resolver. There is no forward lookup other than the root servers via root hints.

2) Under the error state (i.e., when the southwest.com lookups are timing out), nslookup southwest.com ns-1.southwest.com times out looking up the ns-1.southwest.com server. Same thing with ns-2.southwest.com.

3) Under the error state, nslookup southwest.com 12.5.136.190 and nslookup southwest.com 63.169.44.190 (i.e., against the IP addresses of ns-1 and ns-2.southwest.com) both work, returning southwest.com's IP addresses.

4) Under the error state, the cache is unchanged from when things are working normally. That is, dnsmgmt\cached lookups.(root)\com\southwest always shows the following (including the A record for ns-2, which fails (see #2 above)).

Name                        Type                Data
----                        ----                ----
(same as parent folder)     Name Server (NS)    ns-1.southwest.com
(same as parent folder)     Name Server (NS)    ns-2.southwest.com
(same as parent folder)     Host (A)            208.94.152.100
(same as parent folder)     Host (A)            208.94.153.100
ns-2                        Host (A)            63.169.44.190

I suspect we're overlooking something obvious ...

EDIT

(Sorry for the delay. I posted this over 8 hours ago but it never appeared.)

Under the error state,

5) nslookup southwest.com against all *.gtld-servers.net servers succeeded

... QUESTIONS:
    southwest.com, type = A, class = IN
AUTHORITY RECORDS:
->  southwest.com
    type = NS, class = IN, dlen = 7
    nameserver = ns-1.southwest.com
    ttl = 172800 (2 days)
->  southwest.com
    type = NS, class = IN, dlen = 7
    nameserver = ns-2.southwest.com
    ttl = 172800 (2 days)
ADDITIONAL RECORDS:
->  ns-1.southwest.com
    type = A, class = IN, dlen = 4
    internet address = 12.5.136.190
    ttl = 172800 (2 days)
->  ns-2.southwest.com
    type = A, class = IN, dlen = 4
    internet address = 63.169.44.190
    ttl = 172800 (2 days)

------------
Name:    southwest.com
Served by:
- ns-1.southwest.com
          12.5.136.190
          southwest.com
- ns-2.southwest.com
          63.169.44.190
          southwest.com

6) nslookup southwest.com 208.67.222.222 (OpenDNS) succeeded

7) Clearing the cache fixed the problem, but it just returns later.

8) After clearing the cache and doing nslookup southwest.com (which succeeds), the cache now has ns-1's A record (it didn't under the error state, see #4 above)

Name                        Type                Data
----                        ----                ----
(same as parent folder)     Name Server (NS)    ns-1.southwest.com
(same as parent folder)     Name Server (NS)    ns-2.southwest.com
(same as parent folder)     Host (A)            208.94.153.100
(same as parent folder)     Host (A)            208.94.152.100
ns-1                        Host (A)            12.5.136.190
ns-2                        Host (A)            63.169.44.190

9) Note that the DNS server only forwards to the root servers. Can you think of any reason that should cause this problem?

share|improve this question
    
maybe from your DNS server, try nslookup www.southwest.com ns-1.southwest.com and nslookup www.southwest.com ns-2.southwest.com This will show if your DNS server can access their DNS servers. –  Sandman4 Nov 6 '11 at 19:00
    
btw, your DNS server - how it configured - it acts as resolver or it merely forwards requests to your ISP ? - in the latter case, try nslookup www.southwest.com nsX.yourisp.net –  Sandman4 Nov 6 '11 at 19:03
    
Also, the L root IP is current. –  user100178 Nov 7 '11 at 3:55
    
Since the problems is looking-up nameservers names, now, you may try nslookup southwest.com a.gtld-servers.net ... m.gtld-serves.net. See if all requests answered and return both NS and both A records. –  Sandman4 Nov 7 '11 at 7:47
    
Is there an A record for ns-1 in the cache ? - might be the cause. Did you try to empty the cache ? –  Sandman4 Nov 7 '11 at 13:07
add comment

1 Answer

If you forward DNS to your ISP, try doing an nslookup specifying their servers and see if the problem is on their end. If you are using root hints, make sure that the L root server root hint is using the right IP. I've seen that cause some wonkiness on older AD installs.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.