Why is my DNS server returning NXDOMAIN when I can see the record exists? (Stub zone)

Question

I have two stub zones in my DNS database (both AD-Integrated). Let's call them foo.org and bar.org. All DNS servers on my side are Server 2003 R2.

The foo.org zone file contains the following (hostnames changed for security):

foo.org.        NS      ns1.foo.org.
foo.org.        NS      ns2.foo.org.
foo.org.        NS      ns3.foo.org.
foo.org.        SOA     [2010033275], ns.foo.org, admin.foo.org
ns.foo.org.     A       192.168.0.1
ns1.foo.org.    A       192.168.1.1
ns2.foo.org.    A       192.168.1.2
ns3.foo.org.    A       192.168.1.3

The bar.org. zone is as follows:

bar.org.        NS      ns1.foo.org.
bar.org.        NS      ns2.foo.org.
bar.org.        NS      ns3.foo.org.
bar.org.        SOA     [2010011842], ns.foo.org, admin.foo.org

The main issue we're running into is that requests for A records in the bar.org zone often return SERVFAIL. Looking into it a bit more, I found that a request for "ns1.foo.org. A" returned NXDOMAIN. I believe this is causing the failure to query for lookups in the bar.org zone.

What doesn't make sense to me, is why a request for "ns1.foo.org A" would result in an NXDOMAIN response when I can see that the record exists the in the zone database.

Answer 1

Try to capture network traffic, or look at your firewall logs from the time you performed a lookup. If the query goes to a public root server, the .local tld would probably result in an "NXDOMAIN" result.

Provide logs or screencasts/output of manual lookups (like with nslookup or dig), if you need more help

Answer 2

From what I can tell, we should not be using stub zones in our current situation, and I plan to switch to using conditional forwarders.

Microsoft has an article regarding the usage of stub zones and conditional forwarders at http://technet.microsoft.com/en-us/library/cc780434(v=ws.10).aspx.

In this article, it states "In situations where you want DNS clients in separate networks to resolve each others' names without having to query DNS servers on the Internet, such as in the case of a company merger..."

The article goes on to say "Stub zones are used when you want a DNS server hosting a parent zone to remain aware of the authoritative DNS servers for one of its child zones."