Strange DNS problem for which I hope you can help.

Active Directory with NETBIOS name "Shortdomain" and as FQDN "verylongdomainname.lan". Domain controller DC01 behind firewall. IP: x.x.x.1

Customer site, connected over VPN. Customer has local DNS Server. On their DNS Server I wanted to create a new conditional forwarder zone. In DNS manager I enter "verylongdomainname.lan" and when I enter IP x.x.x.1 I first get a timeout but after the timeout it shows the NETBIOS name "Shortdomain" where I would have expected the FQDN name for the server. I then click OK and the zone is added.

On any server in customer site, I fail to resolve any server in "verylongdomainname.lan", but when I start nslookup and then run the command "Server x.x.x.1", I successfully connect to the DNS server and I am then able to resolve all server names in the "verylongdomainname.lan" domain. To me this proves routing and firewalling is permitting a connection from customer to DNS Server x.x.x.1. Correct ???

Any idea why the conditional forwarding is not working and how to fix it?

From the command line:

    command: nslookup
    result: y.y.y.5 

    command: server1.verylongdomainname.lan 
    result: domain not found 

    command: server x.x.x.1 
    result: server (x.x.x.1) 

    command: server1.verylongdomainname.lan
    result: server1.verylongdomainname.lan x.x.x.7 (which is correctly resolved)
  • Can you include more specifics in your question? Maybe include the output of the nslookup commands you are issuing?
    – Zoredache
    Sep 17, 2014 at 18:32
  • Update your question then.
    – Zoredache
    Sep 17, 2014 at 18:55
  • I deleted my extra comments and updated my question with commandline results.
    – Gabrie
    Sep 17, 2014 at 19:07
  • Can the y DNS servers actually reach the x DNS servers? Have you verified that? It would appear that they can seeing as they resolved the names of the forwarders, but I would run some tests from y DNS to x DNS. Also, run nslookup on y DNS server in debug mode when you run your tests so that you can see more detail of the interaction.
    – joeqwerty
    Sep 17, 2014 at 19:27
  • Can you do a debug output of an nslookup instead? (nslookup, then "set option d2" then do your lookups). (oops...like joe said)
    – TheCleaner
    Sep 17, 2014 at 19:49

1 Answer 1


Turned out that the customer DNS Servers itself weren't able to access my DNS Servers. Some NAT rule on customer side wasn't correct. Thanks for the tips!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.