Recently we're having a problem with the "Connection-specific DNS Suffix" automatically changing to an invalid domain on our network.
When a system plugs into the network, our DHCP server gives it the correct domain name suffix using option 15 (DNS Domain Name) = our-domain.com ... this can be verified immediately after getting an ip with ipconfig /all:
Ethernet adapter Local Area Connection: Connection-specific DNS Suffix : our-domain.com
After several minutes, some automatic discovery process finds a new (wrong) connection-specific dns suffix and updates the ip configuration with the new information. After this update with the wrong information, ipconfig /all changes to show:
Ethernet adapter Local Area Connection: Connection-specific DNS Suffix : novalocal
When this "novalocal" domain is discovered, many of my clients begin having name lookup problems.
This is happening to Windows 7 clients, and I've verified that the issue occurs with or without Bonjour installed. I haven't tried disabling SSDP or UPnP services yet. It is happening on clients with either Symantec firewall or Windows firewall turned on.
I did check for rogue DHCP servers, and offers / leases are only coming from my authorized DHCP servers (no rogues seen or sending offers on the network).
Has anyone seen anything like this before? Any suggestions on how I can find where this "novalocal" is coming from and how to prevent my clients from having their DNS suffix settings changed by some automatic discovery?