1

We are seeing this on at least four of our Windows 2008 R2 DNS servers/DCs across two Windows domains.

If no forwarder is set hosts for non-authorized domains are not resolved. Perhaps related: there are "Conditional Forwarders" in place. To workaround this we have set the Windows 2003 DNS servers as forwarders, but its time to retire the Windows 2003 servers.

Current Settings... Forwarders -blank- Use root hints if no forwarders are available. [checked]

Advanced Disable recursion [unchecked] BIND secondaries [unchecked] Fail on load if bad zone data [unchecked] Enable round robin [checked] Enable netmask ordering [checked] Secure cache against pollution [checked]

Root Hints -Populated- a.root-servers.net 198.41.0.4, etc...

What I've tried so far...

I've tried updating the root hints from the Windows 2003 DNS servers, I've also tried from Google's public DNS server (8.8.8.8) as well as 4.2.2.2 http://technet.microsoft.com/en-us/library/cc730735.aspx

I've tried all combinations of forwarders with "Use root hints if no forwarders are available" checked and unchecked. I also tried an invalid forwarder of (127.0.0.2). Also tried toggling the inSlave registry setting. http://support.microsoft.com/kb/2001154

Then I tired to set the Max Cache TTL with its registry setting, DWORD MaxCacheTtl

I'm stumped and about to actually call Microsoft. :(

Improve this question
2
  • This is maybe a stupid one, but have you tried running nslookup locally on the faulty DNS server, and specifying 8.8.8 as the server. Does it resolve queries? Just to elminate firewall problems..
    – pauska
    Feb 18, 2011 at 21:13
  • Yes I can reach 8.8.8.8 and or 198.41.0.4, and thats not stupid. :)
    – Aaron Wurthmann
    Feb 18, 2011 at 21:22

1 Answer 1

Reset to default
2

Got it...

From: http://weblogs.asp.net/owscott/archive/2009/09/15/windows-server-2008-r2-dns-issues.aspx

It appears that the Internet isn’t fully up to date and ready to use EDns quite yet. The solution for this is to disable EDns and wait another year or two until Akamai and other DNS servers catch up....
Note that this isn’t a problem for most Windows Server 2008 R2 member servers. It’s only a problem for DNS servers that do recursive lookups. i.e. likely only your domain controller will be affected if that is where your DNS Server role exists.

Fix

To disable EDns, you can do it from the command prompt, or by editing the registry.

From the command prompt, no restart of DNS is required. If from the registry, make sure to restart the DNS Server service.

Command prompt: 

dnscmd /config /EnableEDNSProbes 0

No restart is needed. It takes effect immediately.

or Registry:

Create a DWORD called EnableEDNSProbes and set to 0 in

HKLM\SYSTEM\CurrentControlSet\services\DNS\Parameters

Restart the DNS Server service for it to take effect.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .