I'm having quite a weird issue. Had mail delivery issues to a specific domain. After looking closer, I realized that the DNS for that domain isn't resolving via the in-house Windows 2003 SP2 DNS server.
C:\>nslookup foodmix.net Server: DC.DOMAIN.com Address: 10.1.1.1 DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. *** Request to DC.DOMAIN.com timed-out
(DC.DOMAIN.com and 10.1.1.1 are generic values to replace the actual ones)
Even if I run this nslookup from the DC.DOMAIN.com server, I get the same result. However, all other requests are working as they should. I had a sysadmin friend try this DNS lookup on servers at several companies that he consults for (which are also Windows 2003 AD servers). The weird thing is some of these were having the same exact issue. However using public DNS servers work. I have tried clearing the DNS cache, restarting the server, restarting the services, etc. Nothing has worked.
One weird event I noticed in the DNS Server Event Logs that might be related is an event ID of 5504 with the following description:
The DNS server encountered an invalid domain name in a packet from 18.104.22.168. The packet will be rejected. The event data contains the DNS packet. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
In the data section below, I can see the following mentioned:
Which happens to be the nameserver for the domain in question. Several discussion threads and a MS KB have pointed to disabling EDNS. I have done this via "dnscmd /config /enableednsprobes 0" and it has not fixed the issue.
I've added a wireshark excerpt(txt) which shows the DNS query. Just to clarify, the internal network is the 22.214.171.124/22 network is the internal network (I didn't set it up, and it's stupid that it's setup this way). The internal DNS server is 126.96.36.199.
So as far as I can see, here's what's happening:
- Internal DNS Server requests A record for foodmix.net from its NS record (ns2.webhostingstar.com) and it recieves no response
- Internal DNS server sends another request under the same transaction ID . It requests A record for foodmix.net from its other NS record (ns.webhostingstar.com) and it recieves no response
- Internal DNS server sends a request under a new transaction ID . It requests an A record for foodmix.net from a nameserver 188.8.131.52 (d.gtld-servers.net).
- It recieves a response from 184.108.40.206 with no records, just listing the authoritative NS servers.