0

I have two AD/DNS servers, and on the secondary I can't seem to lookup the external site www.iis.se (or any other hostname that their name servers control).

The central firewall at this office allows any any outbound, TCP and UDP. The DNS server has no local firewall nor antivirus. My windows client, located in the same subnet as the DNS server can do the lookup by asking the nameservers that are in control of www.iis.se.

dig NS iis.se shows

iis.se.                 2517    IN      NS      ns2.nic.se.
iis.se.                 2517    IN      NS      ns.nic.se.
iis.se.                 2517    IN      NS      ns3.nic.se.

On AD/DNS server:

C:\Users\Administrator>nslookup www.iis.se 212.247.7.228

Server:  UnKnown
Address:  212.247.7.228

Name:    www.iis.se
Addresses:  2a00:801:f0:80::80
          212.247.7.221

C:\Users\Administrator>nslookup www.iis.se 194.17.45.54

Server:  UnKnown
Address:  194.17.45.54

Name:    www.iis.se
Addresses:  2a00:801:f0:80::80
          212.247.7.221


C:\Users\Administrator>nslookup www.iis.se 212.247.3.83

Server:  UnKnown
Address:  212.247.3.83

Name:    www.iis.se
Addresses:  2a00:801:f0:80::80
          212.247.7.221

And still:

C:\Users\administrator>nslookup www.iis.se

Server:  UnKnown
Address:  127.0.0.1

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out

Edit 3

C:\Users\Administrator>ipconfig /all

Windows IP Configuration

   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.180.3.15(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.180.3.254
   DNS Servers . . . . . . . . . . . : 10.180.3.15
                    10.10.10.19

C:\Users\Administrator>nslookup www.test.se
Server:  UnKnown
Address:  10.180.3.15

Non-authoritative answer:
Name:    www.test.se
Address:  216.8.179.24


C:\Users\Administrator>nslookup www.iis.se 127.0.0.1
Server:  localhost
Address:  127.0.0.1

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to localhost timed-out

C:\Users\Administrator>nslookup www.iis.se 10.180.3.15
Server:  UnKnown
Address:  10.180.3.15

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out



C:\Users\Administrator>nslookup www.iis.se 10.10.10.19
Server:  ds-1.company.com
Address:  10.10.10.19

Non-authoritative answer:
Name:    www.iis.se
Addresses:  2a00:801:f0:80::80
          212.247.7.221

1 Answer 1

1

It all looks perfrectly normal to me. The name servers for iis.se are ns.nic.se, ns2.nic.se, and ns3.nic.se.

You get the Server Unknown message because you don't have a PTR zone set up on your DNS servers for your subnet (which isn't required). When you run nslookup from the DNS server the DNS client on the server (which is what nslookup uses, as the DNS server is also a DNS client and operates as any other DNS client does) first performs a PTR lookup to find the name of the server configured in the DNS settings of the TCP\IP protocol bound to the NIC. Not finding a PTR record, nslookup responds with Server Unknown. This is perfectly normal and acceptable.

Next you issue the query for www.iis.se and get a response from one of the name servers at iis.se from both the IPv6 and IPv4 addresses of that name server, that it can't find a record for www.iis.se. This is a perfectly normal response if no record for www exists.

You do that two more times against two different name servers and get the same response, which again is perfectly normal where no record for www.iis.se can be found.

You do that a third time on a server that has 127.0.0.1 configured as it's DNS server in the TCP\IP protocol settings of the NIC and get a request timed out, which tells me that the DNS client is pointing to 127.0.0.1 for DNS but that the DNS server (if you're running this particular nslookup from the DNS server) isn't listening on 127.0.0.1 so the query times out.

Try running nslookup against each of the name servers for the iis.se domain and query each one for www and see what they answer.

9
  • OK, you changed the formatting of your question since I posted my answer, but my answer is basically the same. You issue the nslookup directly against the name servers for the iis.se domain (correct?), get a server unknown response because there's no PTR records for the ip addresses of those name servers, but you get a good response from those name servers, so what's the problem again?
    – joeqwerty
    Jan 7, 2011 at 13:02
  • I don't really understand your answer. All three nameservers that are in control of iis.se, answers with the A record of www.iis.se. But querying 127.0.0.1 (or 10.180.3.15 which is the IP of the DNS server) gives me a timeout. If I query my other DNS server it answers with the correct A record. Let me add that I dont experience problems looking up any other hosts/ips on that DNS server.
    – 3molo
    Jan 7, 2011 at 13:03
  • If the problem is the last nslookup in your question, then see the second to last paragraph in my answer. The DNS client performing the nslookup is using 127.0.0.1 as it's DNS server, and assuming that this is the DNS server itself, the DNS server component is not listening for DNS requests on ip address 127.0.0.1 or it's not responding to DNS requests recieved on ip address 127.0.0.1.
    – joeqwerty
    Jan 7, 2011 at 13:06
  • Check which ip addresses the DNS server is listening on. I've never been a fan of configuring a DNS server to point to itself by using the 127.0.0.1 localhost address. Try putting the real ip address of the DNS server in the DNS client settings and make sure the DNS server is listening on that ip address.
    – joeqwerty
    Jan 7, 2011 at 13:07
  • Also, scratch the part of my answer where I said that the name servers for iis.se don't have records for www. That's not the case. That's what it looked like in the original formatting of your question. The new formatting makes it much clearer what you're doing and what results you're seeing.
    – joeqwerty
    Jan 7, 2011 at 13:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .