Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on a small domain consisting of several Win 2003 servers and workstations connected on a single Win 2003 domain controller.

Occasionally, and without apparent regularity, one of our users (the only non-admin user) experiences DNS resolution failures to one of our web tiers, making the web-app he's working on unreachable but only on that system and to him.

EDIT: Added cases relating to better performance with the A record.

There appears to be a distinction between CNAME and A record results. web1 is a CNAME record and we'll call the system's A record server1.

I've identified the following details on his user account, on his system:

  • nslookup times out but does display the correct IP address
  • nslookup web1 displays the correct address with no timeout
  • nslookup server1 displays the correct address with no timeout
  • ping server1 reaches the server as expected.
  • ping web1 fails to look up IP, does not reach server
  • ping fails to look up IP, does not reach server
  • Event logs on any of the DC, workstation and webserver are clean.
  • Restarting DNS on the DC didn't help.
  • Rebooting the user's workstation didn't help.

Where can I look at this point to try to restore DNS functionality to this user?

share|improve this question
I'm having this exact issue for some guest clients. Are your DNS records A or CNAME? Also, Is 'ping web' a typo for 'ping web1'? – Kev Oct 20 '09 at 17:55
@Kev - yes, that was a typo. – antik Oct 20 '09 at 18:49

Steps I would take:

Clear the DNS cache, using ipconfig /flushdns. If your nslookup is timing out, but returning an IP, it may be falling back on the cache (I am not sure on this ordering).

Verify the DNS server being used, by ipconfig /all. Correct? Then:

Check ping connectivity to the DNS server. Pingable? Then:

Check nslookup against this server, by:

nslookup - a.b.c.d

Did this not work? Try nslookup to other known-good DNS servers (if reachable), such as by:

nslookup -

If that works, but nslookup by itself does not, I would get a packet capture tool like Wireshark and see what's really going on at the protocol level.

share|improve this answer
DNS server is pingable. Results for nslookup against that server are as described in the original question. – antik Oct 20 '09 at 19:10

Temporary workaround: You could statically define some extra A names on your DC if web1/server1 has a static IP address. This is a bit of dodgy hack - but it might work temporarily if it needs to be up and working ASAP.

In DNS Management Console ( dnsmgmt.msc ) on your Domain Controller, in the left-hand pane, expand the DC and right-click 'Forward Lookup Zones' and select 'Add a new zone'. You can then add your 'web1' as a forward lookup zone. Once that's done click on the new 'web1' in the left pane, then in the right pane right-click and add a new static 'A' name which points everything (*) to web1's actual static IP address.

There are two problems with this:

  1. The main one being that this name is no longer dynamic and you'll have to remove/update it if you ever remove Web1 or change Web1's IP address.
  2. The other is that it doesn't actually fix the underlying problem and it will compound everything if you need to add another server and the same thing happens again
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.