1

Throughout the day out DNS servers (2x Win 2k8 R2 servers) are unable to respond to requests. The requests that fail are all on the .root zone that are either cached or obtained from 1 of 5 DNS servers we forward to before going to root hints.

At first I thought the DNS servers we were forwarding to were flaky. So I added some more in. Currently the forwarding list looks like

  1. ISP DNS 1
  2. OPEN DNS 1
  3. ISP DNS 2
  4. OPEN DNS 2
  5. ISP DNS 3

I have tried:

  • Turning off root hints.
  • Set record scavenging to 7 days.
  • Using dnscmd /config /EnableEDNSProbes 0 as per this.

Packet capture at the DNS server shows that there is a lot of query responses with server failure between LAN clients and the local DNS server; it does not appear to be forwarding those requests. So maybe a problem with caching?

Does anyone have anything I can try to get this working?

Forwarders Pane

enter image description here

Here is a cap from the secondary DNS called DC3 with capture filter 'port 53'

Improve this question
13
  • As a first step, remove all of the forwarders. They're more likely to be flaky than the root hints. Secondly, scavenging shouldn't have anything to do with the problem. Scavenging determines how often the DNS server scavenges stale DNS records from zones that it is authoritative for, not DNS records that it has cached from DNS lookups for zones that it is not authoritative for.
    – joeqwerty
    May 30, 2012 at 23:00
  • there isn't any query going to the forwarders. Even if they are flaky shouldn't I see a query?
    – Ablue
    May 30, 2012 at 23:01
  • Try flushing the DNS server cache (from the DNS MMC), start a capture on the server, and try a lookup from a client for an external domain and see what shows up in the capture again.
    – joeqwerty
    May 30, 2012 at 23:03
  • I have. I does work, but intermittently doesn't. There are periods through the day where no lookups for external domains work. It will then begin to work again like 5 minutes later.
    – Ablue
    May 30, 2012 at 23:08
  • There was an issue with older versions of DNS on Windows Server that would not cache certain TLDs correctly. E.g. au would be cached for the wrong period of time, and then after that time expired all requests to au tld would start failing. Haven't seen that issue on 2008 R2 though...
    – Mark Henderson
    May 31, 2012 at 1:00

1 Answer 1

Reset to default
1

Ablue, these are my observations:

Query packet 161 - quad A query dc2 - response packet 162 - server failure.
Query packet 251 - quad A query mx1 - response packet 252 - server failure.
Query packet 2102 - quad A query for Storage1 - response packet 2103 - server failure

Gaps:

Successful response from external DNS ends at Jun 1, 2012 08:40:07 with packet 3913

Queries go out to external servers.
DNS caching server does try multiple servers from forwarders,
but does not receive a response from external servers.

Next response from external server received at Jun 1, 2012 08:40:46 with packet 4147

packet 4147 - packet 4453

4504 - 4600 - 4694
4869 - 5004
5210 - 5234

By looking at these gaps out of your pcap file I can see that your DNS server is going out to the forwarders. However, it is not receiving responses from the forwarders. Have you checked if you had connectivity issues at or beyond your border router/gateway? You seem to be experiencing line dropouts.

By what the timestamps in the packets tell, it's also during the morning rush hour.

Improve this answer
2
  • Yeah, I just noticed that this morning. I can ping the forwarders but I can't resolve from them. NSLOOKUP gives timeouts. I suspect border firewall problem.
    – Ablue
    Jun 1, 2012 at 1:55
  • Confirmed it was the gateway firewall.
    – Ablue
    Jun 4, 2012 at 4:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.