0

I am trying to update a small network to use a Windows 2019 Server Essentials for its domain controller, DNS- and DHCP server - primarily for learning things and experimenting. I have been following a number of guides (like this one or this one). The server itself is a virtual machine under ESXi 6.7 and there will be only one DC.

I have configured a static IP, have added server roles AD, DNS and DHCP, did the basic AD config steps, added a reverse lookup zone to DNS and a default IP range to DHCP. Another client on the network was able to get an IP address via DHCP.

I did follow the recommendation to name the domain as a subdomain of an actual internet domain I own (i.e. ad.domain.tld, where domain.tld is normally a web server on a provider-hosted site).

The server claims to have no internet access - which is not correct - but that seems to be a known issue. DNS also issues a warning #4013 in server manager, but that appears to be "normal" as well.

However, I have a strange problem with DNS, that I have no explanation for.

When I do an nslookup on whichever name, the result is always:

Server: localhost
Address: 127.0.0.1

Non-authoritative answer: xxxx.DOMAIN.TLD
Address: nnn.nnn.nnn.nnn

Where nnn.nnn.nnn.nnn is the IP address of my provider-hosted webserver/domain. It does not matter which name I use - this can be 'amazon.com' (-> amazon.com.DOMAIN.TLD), a local computer 'winclient' (-> winclient.DOMAIN.TLD) or even something invalid like 'x.y.z' (-> x.y.z.DOMAIN.TLD), they all resolve to the exact same IP address.

So maybe I did something stupid or not so obviously wrong, but I have no idea what. Any help would be much appreciated. Let me know what info to provide.

4
  • Would you be able to share how you have your DNS Server configured? Are you using a forwarder? What forwarder are you using? Are you using root hints? What forward lookup zones do you have on your server?
    – Semicolon
    Jan 2, 2021 at 5:00
  • hi i belive you accidentally configured the dns wrongly but please show the dns config
    – djdomi
    Jan 2, 2021 at 8:46
  • I did not do any of the DNS config myself - all came out of the box as defaults when installing Windows Server, AD, DNS & DHCP. Some of the issue may be that my provider-hosted server (DOMAIN.TLD) seems to resolve any subdomain to its IP (even amazon.com.DOMAIN.TLD). Not sure if that is normal or a defect, but I have no influcence on that. That however, does not explain (at least for me) why DNS requests for local names ('winclient') are forwarded at all. Jan 2, 2021 at 9:44
  • How would I show the DNS server config? I do see a list of root hints (all came as default), I do have two forward lookup zones (came as defaults as well). Is there some way to export it as a report/text, or shall I post screenshots? Jan 2, 2021 at 9:48

1 Answer 1

0

After some more digging, it seems that the provider-hosted server and its DNS has a wildcard DNS record (* -> nnn.nnn.nnn.nnn), presumably to facilitate subdomains on the public webserver (so you do not need a new A-record for each subdomain).

However, Windows seems to try a DNS lookup with the domain postfix first, which the public server incorrectly resolves based on its wildcard DNS record. You can actually check the difference by using nslookup amazon.com. (note the dot at the end), preventing the postfix to be added and resolves fine.

I have removed the wildcard DNS record on the public webserver (and entered the few subdomains explicitly).

This has resolved the issue resolving external addresses.

However, for the moment any internal address will result in

Server:  localhost
Address:  127.0.0.1

*** localhost can't find winclient: Non-existent domain

Any reasons for that? Or shall I just wait until some of the previous issues have fully gone away over time?

1
  • This is driving me crazy. I re-created the server, went through the steps as described in the guides. This time, no issue with external addresses any more, but internal network names maintained by DHCP cannot be resolved ("*** localhost can't find winclient: Non-existent domain"). They do show up as leases in the DHCP server, but DNS does not seem to know about these. DHCP server is authorized. Resolving the server itself works fine. Again, everything out of the box, using the wizards. I did not do anything specifically with DNS. Jan 2, 2021 at 20:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .