We are seeing this on at least four of our Windows 2008 R2 DNS servers/DCs across two Windows domains.
If no forwarder is set hosts for non-authorized domains are not resolved. Perhaps related: there are "Conditional Forwarders" in place. To workaround this we have set the Windows 2003 DNS servers as forwarders, but its time to retire the Windows 2003 servers.
Current Settings... Forwarders -blank- Use root hints if no forwarders are available. [checked]
Advanced Disable recursion [unchecked] BIND secondaries [unchecked] Fail on load if bad zone data [unchecked] Enable round robin [checked] Enable netmask ordering [checked] Secure cache against pollution [checked]
Root Hints -Populated- a.root-servers.net 198.41.0.4, etc...
What I've tried so far...
I've tried updating the root hints from the Windows 2003 DNS servers, I've also tried from Google's public DNS server (8.8.8.8) as well as 4.2.2.2 http://technet.microsoft.com/en-us/library/cc730735.aspx
I've tried all combinations of forwarders with "Use root hints if no forwarders are available" checked and unchecked. I also tried an invalid forwarder of (127.0.0.2). Also tried toggling the inSlave registry setting. http://support.microsoft.com/kb/2001154
Then I tired to set the Max Cache TTL with its registry setting, DWORD MaxCacheTtl
I'm stumped and about to actually call Microsoft. :(