(Disclaimer: I am not a Windows DNS admin. I do have a decent amount of DNS experience under my belt though, and this is not making any sense. I am working closely with the admins responsible for these devices and can get tests performed as needed.)

We have run into an issue where we cannot add conditional forwarders that point to BIND nameservers under Windows Server 2012. Adding the IP address of the server results in a validation error: An unknown error occurred while validating the server.

forwarder fail. :(

Looking at the query log on the BIND server, we found something rather interesting: the Windows DNS server was querying for . IN SOA, i.e. the SOA record for the root nameservers. No query for example.com. IN SOA at all. It attempts to query for root authority and doesn't continue when it receives a response of REFUSED.

client (.): query: . IN SOA - (
client (.): query: . IN SOA - (
client (.): query: . IN SOA - (

Madness. To humor it, we reproduced this problem in the lab. I downloaded a copy of the root zone and configured a . zone (commenting out my root hints), and lo and behold, this error no longer occurs.

I really don't get this. I'm providing an authoritative nameserver that shouldn't have to provide answers to . SOA, and as matters stand I'm going to have to add this zone to all of our production servers just to play nicely with Windows 2012. In my experience, a forwarder should only be concerned with whether or not the target nameserver is authoritative for the zone in question.

Why is this happening?

If we try to ignore the error (click on OK anyway), we get the following error dialog:

more forwarder fail. :(

The query log still shows that the upstream server is only asking for . IN SOA. There is never an attempt to see if the server is authoritative for example.com..

  • 2
    The validation fails, but does the conditional forwarder work regardless? (I mean can you just ignore the error?) – Ryan Ries May 21 '15 at 18:44
  • @Ryan I've updated the question with the error dialog that pops up when the admins attempt to add the forwarder anyway. – Andrew B May 22 '15 at 18:25
  • 1
    @AndrewB I tried to reproduce this on both 2012 and 2012R2 but failed. The initial validation error is shown (and I can see the strange query for . IN SOA) but clicking "OK" appears to work (no further errors are shown). Maybe the second error message you get is unrelated to the strange validation behavior? Does Add-DnsServerConditionalForwarderZone (powershell) either work or produce a more helpful error message? – Håkan Lindqvist May 25 '15 at 18:31
  • @Håkan The first warning being unrelated sounds likely and we'll focus on the second one. – Andrew B May 25 '15 at 19:03
  • @Håkan Part of the confusion was that they were apparently attempting to add the forwarder using the server name during the first attempt, which does ghost the OK box and prevent them from continuing. (as opposed to the screenshot above) The remaining problem is unrelated to this issue and I'm going to close the Q&A. Please convert your comment about the confusing validation behavior to an answer so that I can give you credit. – Andrew B May 27 '15 at 16:58

I tried to reproduce this on both Windows 2012 and Windows 2012 R2 but couldn't get the same end result.

I can confirm the initial validation error (An unknown error occurred while validating the server.), and I can see the strange query for . IN SOA, but clicking "OK" at that point appears to work (no further errors are shown and the forwarding zone is added).

It appears that the second error message that you encountered (A problem occurred while trying to add the conditional forwarder. A zone configuration problem occurred.) may be unrelated to the strange validation behavior.

I can't really tell why it is doing its validation based on a query for . IN SOA but it appears to be mostly a cosmetic problem as you're not prevented from proceeding despite the validation failure.


i was facing the same problem and fixed thank for the god. the problem it was in the sort of the DNS IP on the NIC card in the Primary domain must be in the preferred (Primary domain IP) and the alternative is (secondry DC) for all the secondary : in the preferred (seconder domain IP) and the alternative is (Primary DC). try this solution and send your feedback. thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.