DNS Conditional Forwarder refusing requests for _mcdcs.remote.domain
I have a local AD server with DNS installed called (adserver.mydomain.local) To allow trust relationships with other domains we have configured a number of conditional forwards to remote AD servers. All of these work fine except for one: it forwards most requests correctly but when it receives a request for ._msdcs.remote.domain it rejects it without trying to contact the remote server, even after clearing the DNS servers cache. This problem started after the AD servers at the remote location were replaced. This DNS issue causes lookups for the _ldap._tcp.dc._msdcs.remote.domain SRV record to fail, which prevents the AD trust from working correctly as the local servers can find a login server for remote.domain.
If I perform an nslookup directly to the remote.domain DNS servers it works correctly, this problem is only seen when the request is passed through the conditional forwarder. This affects both a windows 2003 and a windows 2008 AD server on the local domain.
The message using nslookup is "adserver.mydomain.local can't find _ldap._tcp.dc._msdcs.remote.domain: Query refused"
Looking at a network trace the DNS server is returning a "refused" response.
Why would the DNs server do this for any addess under _msdcs.remote.domain, and how can I fix it? The conditional forwarders for all other domains are working correctly, it's only this one that is causeing problems. _msdcs.remote.domain
If I sniff the network traffic it looks like this:
Request:
+ Udp: SrcPort = 59685, DstPort = DNS(53), Length = 57
- Dns: QueryId = 0x9, QUERY (Standard query), Query for _ldap._tcp.dc._msdcs.remote.domain of type SRV on class Internet
QueryIdentifier: 9 (0x9)
- Flags: Query, Opcode - QUERY (Standard query), RD, Rcode - Success
QR: (0...............) Query
Opcode: (.0000...........) QUERY (Standard query) 0
AA: (.....0..........) Not authoritative
TC: (......0.........) Not truncated
RD: (.......1........) Recursion desired
RA: (........0.......) Recursive query support not available
Zero: (.........0......) 0
AuthenticatedData: (..........0.....) Not AuthenticatedData
CheckingDisabled: (...........0....) Not CheckingDisabled
Rcode: (............0000) Success 0
QuestionCount: 1 (0x1)
AnswerCount: 0 (0x0)
NameServerCount: 0 (0x0)
AdditionalCount: 0 (0x0)
- QRecord: _ldap._tcp.dc._msdcs.sctcns.net of type SRV on class Internet
QuestionName: _ldap._tcp.dc._msdcs.remote.domain
QuestionType: SRV, Server Selection/NBSTAT, NetBIOS NODE STATUS, 33(0x21)
QuestionClass: Internet, 1(0x1)
Response:
+ Udp: SrcPort = DNS(53), DstPort = 59685, Length = 57
- Dns: QueryId = 0x9, QUERY (Standard query), Response - Refused
QueryIdentifier: 9 (0x9)
- Flags: Response, Opcode - QUERY (Standard query), AA, RD, RA, Rcode - Refused
QR: (1...............) Response
Opcode: (.0000...........) QUERY (Standard query) 0
AA: (.....1..........) Is authoritative
TC: (......0.........) Not truncated
RD: (.......1........) Recursion desired
RA: (........1.......) Recursive query support available
Zero: (.........0......) 0
AuthenticatedData: (..........0.....) Not AuthenticatedData
CheckingDisabled: (...........0....) Not CheckingDisabled
Rcode: (............0101) Refused 5
QuestionCount: 1 (0x1)
AnswerCount: 0 (0x0)
NameServerCount: 0 (0x0)
AdditionalCount: 0 (0x0)
- QRecord: _ldap._tcp.dc._msdcs.remote.domaint of type SRV on class Internet
QuestionName: _ldap._tcp.dc._msdcs.remote.domain
QuestionType: SRV, Server Selection/NBSTAT, NetBIOS NODE STATUS, 33(0x21)
QuestionClass: Internet, 1(0x1)
