Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently found out that the DNS server in my Windows network (Windows Server 2008 R2 also DC) forwards two requests to the external DNS servers.

If I enter a command like:

nslookup google.com dc1.mycompany.local

The domain controller receives it and forwards two requests:

[+] google.com.mycompany.local
[+] google.com

Does anyone know how to disable this, since it doubles the DNS requests unnecessarily

Regards

share|improve this question

2 Answers 2

up vote 0 down vote accepted

The [+] google.com.mycompany.local entry is a result of having your local domain in your clients' domain suffix search list. Removing it would mean that lookups against just a hostname for machines within your domain would fail - all DNS queries would require an FQDN, which may be undesirable.

enter image description here

Having said that, if you wish to disable it, you can do so by GPO. (Or manually on every client.) The GPO is located under: Computer Configuration -> Policies -> Administrative Templates -> Network -> DNS Client Simply append an empty list of suffixes, and none will be added.

share|improve this answer
    
Thanks for the quick response! But there is no way that the DNS Server can strip the entries that include the local domains before forwarding them? –  Christian Mar 7 at 16:39
    
@Christian To where is it forwarding those requests? The DNS server should recognize itself as authoritative for the .mycompany.local domain and handle that request itself. If not, that's the problem you should look into fixing. –  HopelessN00b Mar 7 at 16:50
    
I've built a DNS based webfilter (like Umbrella - former openDNS) and all DNS requests that the DC can't find in his db are forwarded to my dns servers. These servers are specified in the configuration of the DC's DNS server. –  Christian Mar 7 at 16:58
    
@Christian Without knowing the details of your config, I can't explain exactly how, but you basically need/want to exclude lookups in that zone from being forwarded. If you even decide it's worth the trouble. I can't personally see spending more than 15 minutes on this before deciding it's more trouble than it's worth. –  HopelessN00b Mar 7 at 17:21

How are you determining that the server is forwarding the request? The server receiving the request and the server forwarding the request are two different things. Have you run a packet capture on the server to verify that the server is forwarding the request?

The behavior, except for the forwarding if that is actually happening, is perfectly normal when using nslookup and submitting a query that isn't fully qualified. You omitted the trailing dot (.) in your query (google.com instead of google.com.) and as such the local DNS suffix (primary and/or connection specific) will be appended to the query when submitting it to the server. This is a function of nslookup and not the DNS client itself. See here for clarification:

http://support.microsoft.com/kb/200525

I ran a test using my DNS servers and my DNS servers did not forward the request with the local DNS suffix. They only forwarded the request after the local DNS suffix had been stripped.

I've included 2 screen shots to illustrate my point. In the first screenshot you can see my nslookup query from the client with debugging turned on. In the second you can see the DNS traffic as captured on my server. You'll see clearly that the server receives the requests with and without the local DNS suffix appended but only forwards the query once the local DNS suffix has been stripped off.


enter image description here


enter image description here

share|improve this answer
    
I issued the nslookup command on a client in the network. The external DNS server that the 2k8 server is forwarding external domains to is connected to my syslog server. When I start the nslookup I can see the two requests coming from the Windows server on the syslog. The server it's being forwarded to is in a different network (and location). edit You can even see the same thing on your first screenshot. The Authority record says www.relsys.com.home.local and this is wat is being sent to your external DNS.. so eg. the google dns servers see your local domain name in every request –  Christian Mar 7 at 18:31
    
No, you're mistaken. My first screenshot shows nslookup on the client and shows nslookup appending the local DNS suffix to the query that is being sent to my local DNS server. The second screenshot shows the requests from nslookup coming into my local DNS server and shows the requests that the server sends to the forwarders. You can clearly see that the server receives both requests but only forwards the request that has had the local DNS suffix stripped off. The server does not forward the query with the local DNS suffix affixed. –  joeqwerty Mar 7 at 22:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.