Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I hate to have to do this, but i feel up that creek with no... well, some of you might know. At the moment my one and only DNS server refuses to do Forwarding. The story is as goes: This site had 2 servers, one W2003SBS and an W2003StdR2. The SBS degraded over a short periode of time, and to not go down with it i decided to move all data over to the other server. This was of course an AD integrated site. Move went ok, the Std server removed from the domain, and the SBS put to rest. For the time being we decided to run the Std as a server only, and no AD. We renamed the internal domain to xxx.local, and set the server up with DNS, DHCP and installed WINS (not activated). Forwarding of DNS is to our ISP through a Netgear Firewall. The same address setup used as before. So - DNS server started and all went ok, clients reconfigured and hooked up and then - after a day's time - internet name resolution stopped working on the server! Nothing had changed, been altered, modified, nothing! What i now get when doing NSLOOKUP is just a 2 sec timeout response! And i have checked and looked, but to no avail. Anybody seen this behaviour before? And yes - ALL servicepacks have been updated on the server.

I would be much obliged if anyone in here could lend an ear... and give advice! Thanks.... from Tor in Norway

Today is the 14th, and i still have no resolution to this nagging problem. Anybody else got any advice in the matter? Please?

share|improve this question
What does netdiag.exe (You may have to install the Resource Kit to get that) have to say about your networking configuration? Also, any events in the system event log that might relate? – Mark Allen Dec 8 '09 at 22:07
Yes, i'll check into that and get back asap! – Tor Dec 8 '09 at 22:11
Installed, ran and it passed with flying flags. As to the event log: DNS log is keeping track with zone writes, System log also mostly fine, but... with 60 min interval there seem to be some trouble: an LSASRV warning evID 40960 cat SPNEGO saying: Authentication error for the server DNS/xxx. Failure code from auth prot Kerberos was "There are currently no logon servers available to service the logon request (0xc000005e)" So.. THAT particular one i have never seen before! – Tor Dec 8 '09 at 22:40
I think that one may just be a red herring: 824217 LSASRV Event IDs 40960 and 40961 When You Promote a Server to a Domain Controller Role;EN-US;824217 – Mark Allen Feb 16 '10 at 0:57

From the server itself, use nslookup to issue queries to the "forwarded" DNS server with the command: nslookup <some Internet name> <IP address of forwarded server> (like nslookup, etc). That won't tell you if the request is getting out to the 3rd party DNS server or not, if it fails (since you won't be able to tell if the outgoing request isn't making there or the response isn't getting back), but it will tell you, if you do get a response, that the 3rd party DNS server is okay.

I'd be suspicious that the 3rd party DNS server isn't answering right. I'd remove the forwarder configuration, allowing the DNS server to fall back to its default configuration, which uses "root hints" to resolve Internet DNS names against the root DNS servers.

Of course, if your firewall device has somehow gone crazy and is dropping outgoing DNS requests or inbound responses, using "root hints" won't work, either. If you have the resources, I'd consider sniffing the traffic on the outside of your firewall (with Wireshark or some such) to be sure that the DNS requests are actually getting passed out to the 'net.

share|improve this answer
Oh i did that, thanks for suggesting. Got the same timeout. Tried to debugtrace the DNS, and seems request gets kicked up to 1st Root Server, and somewhere on its way back there is a NXDOMAIN reply. Sound a bit ominous to me, but... And just to add - i DO have reinstalled the DNS server, to no avail. – Tor Dec 8 '09 at 22:48
If i may add this info before i fall asleep here... getting late: Did debugtrace in DNS when doing NSLOOKUP Seems the server (i have removed the forwarders!) manages to query some 5 root servers before i get the 2 second timeout. So the packets go out and returns. I have to take a break and be back. Thanks for your answers! – Tor Dec 9 '09 at 0:54

Check out this: I ran into a similar issue which may be the same. Basically EDns is enabled by default with R2, but the Internet isn't ready for it, and Microsoft's EDns doesn't automatically fail back. Not sure why yours' worked for a day first, but it may still be the same issue.

share|improve this answer
Hey there.. yes i am aware of that nicety. Not changed registry yet, cause as you said: why the heck did all work ok first day and a bit? Have it as an option though. Thanks! – Tor Dec 8 '09 at 22:44
And.. if i may add.. This client im hollering from gets resolved. No problem, cause i have added the ISPs primary DNS server to the interface list. So since port 53 gets its packets both out and in, i guess there should be no issues with any blocking in the Netgear Firewall we are using. AND - it did use to work, even from the server! – Tor Dec 8 '09 at 22:59
Ok, so i have disabled EDns by dnscmd. Should take effect immediately, but.. no change, alas. So i guess i am still stuck... – Tor Dec 8 '09 at 23:40

This might seem silly - and it certainly is a flier - but have your tried stopping and then starting your DNS Server from the MMC snapin? Not a restart but a full stop and start. Don't ask me why but I've seen this fix a few of my DNS servers that decided they just didn't want to answer queries anymore.

share|improve this answer
Hi there! Yes, i have done that too. Both start/stop/restart and reboot and in Services done the same and... Still it servers nicely locally but NOT externally. I feel like at my wits end here.. and beyond :-) – Tor Dec 9 '09 at 0:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.