1

Folks: I'm moving from an old SBS2003 network to Server 2012, and thought I'd take the opportunity to have a spring clean by creating an entirely new AD. My old domain was mycompany.local, however it seems that best practice now seems to be to use a subdomain of a registered domain, so I've gone with core.mycompany.com.

I've created my first DC (with DNS forwarders added pointing to our ISP's DNS servers), and all is well apart from a dns forwarding issue. If I start an nslookup session on the DC, and query for "myhost", the address is resolved correctly. If however I query for an internet host (eg "www.microsoft.com"), then the query is forwarded on to our ISP DNS, but in the form "www.microsoft.com.mycompany.com", so this of course hits our public DNS. I get the same problem if I query for a fully qualified internal host (eg "myhost.core.mycompany.com" hits our ISP DNS as a query for "myhost.core.mycompany.com.mycompany.com").

I'm sure I'm missing something obvious here, but I can't figure what it is!

0

That's perfectly normal and shouldn't cause any problems. Let me explain:

What you're seeing is nslookup querying for a name that wasn't fully qualified and DNS devolution kicking in. You submitted a query to nslookup that wasn't fully qualified. A fully qualified query needs to contain the trailing dot(.).

What you submitted was www.microsoft.com, without the trailing dot(.). Nslookup appends the DNS suffix and any parent suffixes of the client (the computer you're running nslookup from) and queries for www.microsoft.com.corp.company.com and gets an NXDOMAIN answer from your internal DNS server. DNS devolution kicks in and removes the leftmost label (now making the query www.microsoft.com.company.com) and the query then gets forwarded to your ISP as www.microsoft.com.company.com. Your ISP then forwards the query to the name server for your public domain (company.com) which appears to have a catchall/wildcard for any name not having a specifc A record in the company.com DNS zone. Your public DNS server then answers with whatever the catchall/wildcard record has.

You can see this by running nslookup in interactive mode and setting debug:

C:\>nslookup
Default Server: blah.corp.company.com
Address: x.x.x.x
>set debug
>www.microsoft.com

Then watch the debug output. Then query for www.microsoft.com. (with the trailing dot) and notice the difference in the debug output.

C:\>nslookup
Default Server: blah.corp.company.com
Address: x.x.x.x
>set debug
>www.microsoft.com.

Not to worry. The DNS client in Windows knows to use the trailing dot(.) even if you don't, so DNS resolution works correctly without you needing to worry that there's a problem. You can test this by opening your browser to www.microsoft.com and verifying that it does indeed go to Microsofts web site.

  • Thanks for taking the trouble joeqwerty - so I was missing something obvious! – peteg Mar 23 '13 at 14:19
  • Glad to help... – joeqwerty Mar 23 '13 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.