I manage the IT for a small company and we're having a very strange internal DNS resolution problem. Periodically during the day certain computers will suddenly be unable to resolve internal host names. It happens on my laptop frequently. Internet DNS resolution still works fine while internal DNS resolution is not functioning. It will not be a site wide problem and it will only last on a computer until either A, the DNS resolver cache is flushed on the computer, or B an indeterminate amount of time passes and DNS resolution goes back to normal. As an example, when this happens, if I ping the hostname of one of our internal servers I get a public IP address.

I've looked at the Event Viewer on both the local computer having the problem and on both DNS servers and have seen no interesting information. There is one other interesting tidbit. We have 3 small labs in our main office and these labs have computers that access resources on a network share. For whatever reason, the credentials that access this information will sometimes lock out that account. I've used the Microsoft tools to troubleshoot account lockouts and noticed that when there is a problem only bad login attempts are being made towards our secondary AD/DNS server. Meaning, when I look at the LockOut Status tool I'll see "Bad Password Attempts" against our secondary DNS/AD server but none against our primary DNS/AD server.

Any help in troubleshooting this issue or tips with things to try would be greatly appreciated.


Your DHCP server is handing out multiple values for DNS servers. At least one of these values does not host your internal domain name. This is bad. AD joined computers should never use DNS servers that aren't internal and hosting the internal domain name (typically all DCs will do this).

So change your DHCP settings so the only servers handed out for DNS are your own DNS servers.

| improve this answer | |
  • DHCP gives out two DNS servers, both being internal DNS servers. – natediggs Sep 7 '11 at 15:28
  • Are you sure you don't have a rogue DHCP server out there. The behavior is so typical of non-AD DNS server. You should check out (and maybe post) ipconfig /all on some offending machines. – Jason Berg Sep 7 '11 at 15:31
  • So I did an ipconfig /all and sure enough, the DHCP server was giving out an internet DNS server, which was an incorrect configuration. Thanks a lot for the help. Hopefully this will resolve this annoying problem once and for all. – natediggs Sep 7 '11 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.