Active Directory DNS not resolving ANY queries

Question

I'm experiencing some weird behaviour with our AD Dns resolver. Our Windows network uses the AD as it's DNS resolver, which then in turn resolves queries like Google.com and so on. All fine and dandy there.

I fired up dig (On Windows, Yay!) one day to showcase an issue for a colleague, and I queried: $ dig ANY google.com. The result was extremely little, and only had A records, which initially got me thinking that Google had killed their service. Better thoughts prevailed, and I queried: $ dig ANY @8.8.8.8 google.com, of course this gave the expected humongous result with all records.

I've discovered what seems like a caching trick on Microsoft's part, where they piece together a response for the ANY query, based on its current cache. The following steps will help reproduce the issue. Do all these steps against and AD DNS server.

1. Query a target domain using the ANY query: $ dig ANY example.com. Notice the result only has A and AAAA records.

2. Query the target domain using another type, such as MX or TXT: $ dig MX example.com. Verify the results are as expected.

3. Issue the original ANY query again, notice now that the results include the MX records from step 2.

I find it best to pick a new domain every test, as the previous test will have cached results in the AD DNS. Use Google's resolver (or other resolvers) to verify expected results, like such: $ dig ANY example.com @8.8.8.8.

Can anyone confirm this? Is it a setting in the AD DNS that prevents it from recursively resolving ANY queries - because they're somehow magically more expensive than anything else?

I for one find this behaviour as outright wrong.

Answer 1

The answer is that ANY actually isn't a DNS resource type. Instead, it refers to the Query type *. According to wikipedia, "Returns all records of all types known to the name server. If the name server does not have any information on the name, the request will be forwarded on. The records returned may not be complete. For example, if there is both an A and an MX for a name, but the name server has only the A record cached, only the A record will be returned." The idea is expressed more explicitly in RFCs 1034 and 1035 if you're curious.

So, your Windows AD DNS server is responding as it should as you've asked it to respond - with the information it presently has cached.

Try doing a dig MX google.com or dig TXT google.com then repeat your dig ANY google.com.

Good Luck.