We are seeing this on at least four of our Windows 2008 R2 DNS servers/DCs across two Windows domains.

If no forwarder is set hosts for non-authorized domains are not resolved. Perhaps related: there are "Conditional Forwarders" in place. To workaround this we have set the Windows 2003 DNS servers as forwarders, but its time to retire the Windows 2003 servers.

Current Settings... Forwarders -blank- Use root hints if no forwarders are available. [checked]

Advanced Disable recursion [unchecked] BIND secondaries [unchecked] Fail on load if bad zone data [unchecked] Enable round robin [checked] Enable netmask ordering [checked] Secure cache against pollution [checked]

Root Hints -Populated- a.root-servers.net, etc...

What I've tried so far...

I've tried updating the root hints from the Windows 2003 DNS servers, I've also tried from Google's public DNS server ( as well as http://technet.microsoft.com/en-us/library/cc730735.aspx

I've tried all combinations of forwarders with "Use root hints if no forwarders are available" checked and unchecked. I also tried an invalid forwarder of ( Also tried toggling the inSlave registry setting. http://support.microsoft.com/kb/2001154

Then I tired to set the Max Cache TTL with its registry setting, DWORD MaxCacheTtl

I'm stumped and about to actually call Microsoft. :(

  • This is maybe a stupid one, but have you tried running nslookup locally on the faulty DNS server, and specifying 8.8.8 as the server. Does it resolve queries? Just to elminate firewall problems.. – pauska Feb 18 '11 at 21:13
  • Yes I can reach and or, and thats not stupid. :) – Aaron Wurthmann Feb 18 '11 at 21:22

Got it...

From: http://weblogs.asp.net/owscott/archive/2009/09/15/windows-server-2008-r2-dns-issues.aspx

It appears that the Internet isn’t fully up to date and ready to use EDns quite yet. The solution for this is to disable EDns and wait another year or two until Akamai and other DNS servers catch up....
Note that this isn’t a problem for most Windows Server 2008 R2 member servers. It’s only a problem for DNS servers that do recursive lookups. i.e. likely only your domain controller will be affected if that is where your DNS Server role exists.


To disable EDns, you can do it from the command prompt, or by editing the registry.

From the command prompt, no restart of DNS is required. If from the registry, make sure to restart the DNS Server service.

Command prompt:

dnscmd /config /EnableEDNSProbes 0

No restart is needed. It takes effect immediately.

or Registry:

Create a DWORD called EnableEDNSProbes and set to 0 in


Restart the DNS Server service for it to take effect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.