Our organization's primary DNS server is a Windows Server 2008 which two Forwarders set. I happened to notice on our firewall that this server is sending out regular TCP requests to the Forwarders in addition to the standard UDP queries. I ran Wireshark on the server and noticed the rate varies but is around 2 packets per second. All the packets are nearly the same:
<server> <forwarder> TCP 62 55148 > domain [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
Occasionally the forwarder responds with a reset:
<forwarder> <server> TCP 60 domain > 55148 [RST, ACK] Seq=1 Ack=0 Win=0 Len=0
Is this normal, expected behavior or should I be concerned? I don't see our other DNS servers exhibiting this same behavior. This is our only Windows server that is sending some DNS packets via TCP.