I have two domain controllers in my domain in remote offices (Europe and China) and two domain controllers in the US, 4 in total. We had a network outage in our US office a few weeks back and during this time, the office in Europe and China experienced issues with DNS not working. I believe part of the issue is that the China server had no forwarder IP addresses set up and the Europe Server did, but it was for our local US ISP.

I want to play around with making some changes to the IP addresses of the DNS Forwarders on these servers but I'm unsure how to test if my changes fix the issue. I would like to avoid disconnecting these remote DC's from our primary DNS servers here in the US. Since everything is up and running well now, if I do nslookup to a website or visit a website in a browser, it will just use our primary DNS servers - how can I specifically test if the DNS forwarder IP addresses are working?

Thanks in advance, let me know if I can give more info or clarify anything


Without repeating the incident you can't troubleshoot it - there is no way to know what went screwy with your DNS traffic unless you make it happen again.

Given your problem description, my money is on "Wrong or missing forwarders" like you guessed.

If, as you describe, your European servers are pointing at the US server as a forwarder there are a few sub-optimal results:

  1. Any time you ask for a zone the European server doesn't know about it asks America.
  2. America doesn't know, so it asks it's forwarder (and so on until we get to the root).
  3. America gets the answer, and sends it back to Europe.

That's at least two trips across the ocean -- not great. And if the American name server goes away Europe has nobody to ask.

For best results, each regional nameserver should have all your internal zones, and be configured with a nearby forwarder if it needs to ask someone else for the record.
This lets you benefit from the caches at your upstream provider, and if your domain gets fractured you can still resolve external DNS names.

How can you test this? On Unix we would use the dig tool (dig +trace).
This is not included with Windows as far as I know, but there are implementations of it available (Google dig for windows for more options).

The +trace option shows you which servers were queried in the process of getting you an answer.

Special Note

There are some circumstances where I suggest using an alternate forwarder (or the root servers directly) -- If you have an ISP that hijacks DNS requests and does not properly return NXDOMAIN for non-existent domain names you should not use their DNS servers.

If you have such an ISP configure an alternative forwarder (like Google Public DNS) instead, or use root hints and ensure that you keep your hints data current.


So many things to say.

  1. Why use forwarders for external DNS resolution? You're introducing a point of failure and introducing possibly wonky results from whatever forwarders you choose. Why rely on some external ISP to provide external DNS resolution for you? Use the root hint servers instead.

  2. If you want to test the functionality of the forwarder then query it directly using nslookup.

  3. Your statement "I would like to avoid disconnecting these remote DC's from our primary DNS servers here in the US" doesn't make any sense. What do you mean "disconnect"?

  4. If a Windows DNS server isn't configured to use forwarders then by default it will use the root hint servers.

  5. When you experienced the issue what type of DNS problems did you have? Was it a failure of internal DNS resolution or external DNS resolution?

  • 4
    The root servers have such a heavy load, it's considered good etiquette to use forwarders instead. Certainly, it's best practice to include multiple forwarders (I usually configure at least 4), but I wouldn't go as far as recommending that everyone use root hints.
    – MDMarra
    Feb 7 '13 at 22:45
  • 2
    I would go so far as recommending that people NOT use root hints unless (a) they fully understand the implications on the internet infrastructure, and (b) they commit to keeping their hints file up to date (it DOES change, and stale hints can ruin your day).
    – voretaq7
    Feb 7 '13 at 22:47
  • What's the real difference between my DNS server hitting the root hint servers and my ISP's DNS server hitting the root hint servers on my behalf in terms of load on the root hint servers?
    – joeqwerty
    Feb 7 '13 at 22:57
  • 1
    @joeqwerty To you? Probably none (unless your ISP has the data cached already, in which case you made a 15ms local round-trip instead of a 40ms-or-more round-trip to the root server). To the roots? One more query (which may be the proverbial straw that crushes the equally proverbial camel). "One More Query" adds up quickly - 100 people on your ISP asking for google.com might be one query to the root if forwarders are used properly, versus 100 queries if they're not.
    – voretaq7
    Feb 7 '13 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.