(Disclaimer: I am not a Windows DNS admin. I do have a decent amount of DNS experience under my belt though, and this is not making any sense. I am working closely with the admins responsible for these devices and can get tests performed as needed.)
We have run into an issue where we cannot add conditional forwarders that point to BIND nameservers under Windows Server 2012. Adding the IP address of the server results in a validation error:
An unknown error occurred while validating the server.
Looking at the query log on the BIND server, we found something rather interesting: the Windows DNS server was querying for
. IN SOA, i.e. the SOA record for the root nameservers. No query for
example.com. IN SOA at all. It attempts to query for root authority and doesn't continue when it receives a response of
client 192.168.203.20#59067 (.): query: . IN SOA - (192.168.208.201) client 192.168.203.20#50553 (.): query: . IN SOA - (192.168.208.201) client 192.168.203.20#55468 (.): query: . IN SOA - (192.168.208.201)
Madness. To humor it, we reproduced this problem in the lab. I downloaded a copy of the root zone and configured a
. zone (commenting out my root hints), and lo and behold, this error no longer occurs.
I really don't get this. I'm providing an authoritative nameserver that shouldn't have to provide answers to
. SOA, and as matters stand I'm going to have to add this zone to all of our production servers just to play nicely with Windows 2012. In my experience, a forwarder should only be concerned with whether or not the target nameserver is authoritative for the zone in question.
Why is this happening?
If we try to ignore the error (click on OK anyway), we get the following error dialog:
The query log still shows that the upstream server is only asking for
. IN SOA. There is never an attempt to see if the server is authoritative for