Windows DNS Server (2008) and Additional Records (or Section)

Question

I am unclear on how the Windows DNS server is supposed to used additional records (or additional section).

From a packet sniff I am noticing the following:

query root server for domain.com
response: gltd ns servers for .com (with additional records)
query GLTD server for domain.com
response: ns1.server.net (and ns2) for domain.com (with additional records)
query root server for ns1.server.net
response: gltd ns servers for .net (with additional records)
....

What I am confused on is why is the windows DNS server not using the IP in the Additional Records for ns1.server.net - but it goes and queries root servers? (not caching is disabled)

Answer 1

This happens for security reasons - to prevent DNS spoofing (cache poisoning).

Your DNS server knows that these GTLD servers are authoritative for .com because it just got the referral for this from the root. Therefore it accepts the two NS-records as their record names are under .com.

However it does not know if these GTLD servers are also authoritative for .net or not. Therefore it cannot trust the additional records with record names under .net (they could be cached poison), and it restarts at the root to be sure.

Answer 2

I believe I found the setting that controls this feature: http://support.microsoft.com/kb/316786

"Secure Cache Against Pollution setting" is one of the settings enabled.