0

I have a Windows Server 2012 domain controller with DNS Server role installed. I configured several DNS servers as forwarders and that's working absolutely fine. All DNS requests are resolved.

Now I noticed in my firewall logs, that my DNS server permanently tries to reach gtld-servers.net on port 53, which is blocked by the firewall. Although there are none of these IP's configured as forwarders! Can you tell me, why it does that? I don't see any reason why.

IP's it tries to reach on port 53, but which are blocked:

  • 192.5.6.30
  • 192.42.93.30
Improve this question
7
  • Why are you blocking access to authorative nameservers?
    – Torin
    Feb 19, 2018 at 11:48
  • Because I have my own dns servers defined as forwarders.I just want to understand why it tries to reach dns servers which aren't configured as forwarders? It didn't do that in the past, I see those logs for the first time. Malware?
    – mountain_climber
    Feb 19, 2018 at 11:53
  • Is it possible that one or more of your configured forwarders don't perform recursion?
    – joeqwerty
    Feb 19, 2018 at 16:11
  • How can I find that out?
    – mountain_climber
    Feb 20, 2018 at 14:22
  • The thing is, the whole problematic started two weeks ago. Before, we never had that problem. So something changed...
    – mountain_climber
    Feb 20, 2018 at 14:29

2 Answers 2

Reset to default
1

By default, there is an option to Use root hints if no forwarders are available, which you can turn off, if you only want the forwarders to be used.

Root hints are only used if forwarders are not configured or fail to respond. So the reason why it tries to reach other servers, might be that it that the forwarders fail to respond (in time) or fail to lookup some name.

To find out what's going on, you can turn on Debug Logging for the DNS server or use a packet analyzer like Wireshark.

Improve this answer
4
  • I can analyze the packets, you are right. But I'm still wondering what happened in the meantime. Two weeks ago, everything was fine. It started on February 7, 2018
    – mountain_climber
    Feb 21, 2018 at 8:01
  • If you can see what computer and port it's coming from, you should be able to see which program it's from. Have you figured that out?
    – PatrikN
    Feb 21, 2018 at 15:18
  • Sorry? the packets are originated at the domaincontroller/dns server
    – mountain_climber
    Feb 22, 2018 at 15:08
  • You can try Wireshark then and hopefully see the traffic and which local port it's coming from. Then you can check which program it belongs to from Cmd with Netstat -no | Find "11111" or whatever the port number is.
    – PatrikN
    Feb 22, 2018 at 16:05
0

In the DNS Management console > server properties > Forwarders tab, you need to UNcheck the box for "Use root hints if no forwarders are available", and you need to remove all the entries in the %SYSTEMROOT%\System32\DNS\Cache.DNS file.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .