DNS Failure for One User on Domain

Question

I'm working on a small domain consisting of several Win 2003 servers and workstations connected on a single Win 2003 domain controller.

Occasionally, and without apparent regularity, one of our users (the only non-admin user) experiences DNS resolution failures to one of our web tiers, making the web-app he's working on unreachable but only on that system and to him.

EDIT: Added cases relating to better performance with the A record.

There appears to be a distinction between CNAME and A record results. web1 is a CNAME record and we'll call the system's A record server1.

I've identified the following details on his user account, on his system:

• nslookup web1.fqdn.com times out but does display the correct IP address
• nslookup web1 displays the correct address with no timeout
• nslookup server1 displays the correct address with no timeout
• ping server1 reaches the server as expected.
• ping web1 fails to look up IP, does not reach server
• ping web1.fqdn.com fails to look up IP, does not reach server
• Event logs on any of the DC, workstation and webserver are clean.
• Restarting DNS on the DC didn't help.
• Rebooting the user's workstation didn't help.

Where can I look at this point to try to restore DNS functionality to this user?

Answer 1

Steps I would take:

Clear the DNS cache, using ipconfig /flushdns. If your nslookup is timing out, but returning an IP, it may be falling back on the cache (I am not sure on this ordering).

Verify the DNS server being used, by ipconfig /all. Correct? Then:

Check ping connectivity to the DNS server. Pingable? Then:

Check nslookup against this server, by:

nslookup - a.b.c.d

Did this not work? Try nslookup to other known-good DNS servers (if reachable), such as 4.2.2.2 by:

nslookup - 4.2.2.2

If that works, but nslookup by itself does not, I would get a packet capture tool like Wireshark and see what's really going on at the protocol level.

Answer 2

Temporary workaround: You could statically define some extra A names on your DC if web1/server1 has a static IP address. This is a bit of dodgy hack - but it might work temporarily if it needs to be up and working ASAP.

In DNS Management Console ( dnsmgmt.msc ) on your Domain Controller, in the left-hand pane, expand the DC and right-click 'Forward Lookup Zones' and select 'Add a new zone'. You can then add your 'web1' as a forward lookup zone. Once that's done click on the new 'web1' in the left pane, then in the right pane right-click and add a new static 'A' name which points everything (*) to web1's actual static IP address.

There are two problems with this:

1. The main one being that this name is no longer dynamic and you'll have to remove/update it if you ever remove Web1 or change Web1's IP address.
2. The other is that it doesn't actually fix the underlying problem and it will compound everything if you need to add another server and the same thing happens again