I'm experiencing some weird behaviour with our AD Dns resolver. Our Windows network uses the AD as it's DNS resolver, which then in turn resolves queries like Google.com and so on. All fine and dandy there.
I fired up dig (On Windows, Yay!) one day to showcase an issue for a colleague, and I queried:
$ dig ANY google.com. The result was extremely little, and only had
A records, which initially got me thinking that Google had killed their service. Better thoughts prevailed, and I queried:
$ dig ANY @188.8.131.52 google.com, of course this gave the expected humongous result with all records.
I've discovered what seems like a caching trick on Microsoft's part, where they piece together a response for the
ANY query, based on its current cache. The following steps will help reproduce the issue. Do all these steps against and AD DNS server.
Query a target domain using the
$ dig ANY example.com. Notice the result only has A and AAAA records.
Query the target domain using another type, such as
$ dig MX example.com. Verify the results are as expected.
Issue the original
ANYquery again, notice now that the results include the
MXrecords from step 2.
I find it best to pick a new domain every test, as the previous test will have cached results in the AD DNS. Use Google's resolver (or other resolvers) to verify expected results, like such:
$ dig ANY example.com @184.108.40.206.
Can anyone confirm this? Is it a setting in the AD DNS that prevents it from recursively resolving
ANY queries - because they're somehow magically more expensive than anything else?
I for one find this behaviour as outright wrong.