Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite

We have a Server 2003 running DNS with Root Hints but with some forwarders for specific domains that contain private services.

The DNS servers for the private services are on site to site links, and every now and again link latency or small down times will cause a DNS lookup to fail, and our Server 2003 caches this fail and propagates it to all clients, who then also cache the fail.

The link may have been down for less than a minute, but if the caches are left to their own device, team members may not be able to browse the intranets for 10+ minutes.

1) How do I stop Server 2003 from caching failed lookups, or to expire failed lookup cache entries after 30 seconds.

2) How do I control the same cache in Windows XP & Win 7 client PCs in a domain environment?

TIA

share|improve this question

1 Answer

up vote 3 down vote

DNS recursers cache NXDOMAIN responses; they do not cache timeout responses.

The way you've got DNS configured (with your specific private domains set up as forwarders) sounds like the real problem. Once your recursers figure out that their forwarders are down, they're doing the lookup themselves recursively, where they end up with an NXDOMAIN response.

You should be delegating to the private DNS servers for the domains that you want looked up against them (have a look at stub zones) instead of having them be your forwarders; every lookup your servers get is being sent to them, not just the ones for their zones. Those systems being down changes the perspective from which your systems are seeing the DNS hierarchy; this is the root of your problem.

share|improve this answer
I briefly investigated using stub zones, but when I followed the wizard the DNS server connected to the remote server and was told it didn't have authentication to mirror the domain (or something similar). The partner we use will not change their DNS settings to make this work. – Dom Dec 6 '11 at 6:52
If your servers are trying a zone transfer, then you selected secondary zone, not stub zone. And yes, if they're configured as a forwarder, all queries will be sent to them; root hints are not used until all forwarders are down. – Shane Madden Dec 6 '11 at 6:58
Your other note said "every lookup your servers get is being sent to them, not just the ones for their zones." This is incorrect. In MS DNS Servers, you can specify a forwarder for specific domains only, which is what we've done. I'm reading about DNS recusion to see if turning it off for the forwarder domains will stop the server trying to use Root Hints if the forwarders are down. – Dom Dec 6 '11 at 6:59
root hints are not used until all forwarders are down. – Shane Madden. That is not correct MS allows definition of forwarded for specific domains only. One of the domains being "All other DNS domains" – Dom Dec 6 '11 at 7:01
Fair enough, I assumed that you were not using conditional forwarding. But, yeah, that's the main thing; you're getting NXDOMAIN responses from internet DNS; you'll need to avoid that in one way or another. – Shane Madden Dec 6 '11 at 7:04
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.