0

We have DNS servers hosted on our Windows domain controllers, 2012R2. Currently we have a conditional forwarder for ad.trusted-domain.com, which is working fine. We'd like to also forward PTR queries for their IP range, so I created a conditional forwarder 30.20.10.in-addr.arpa to their DNS servers. However, it seems it doesn't work. When I do nslookup 40.30.20.10.in-addr.arpa I get NXDOMAIN. If I point it to their server, it works: nslookup 40.30.20.10.in-addr.arpa 10.20.30.5 returns the name of the machine.

Is there anything special needed when forwarding reverse domains? All the documentation and forum posts/blogs etc I've read while troubleshooting indicates that there shouldn't be any magic involved.

Improve this question
2
  • Did you ensure that the record you were testing wasn't already in the negative cache? If you did not roll back the forwarder, the negative cache entry should have expired by now. Failing that, NXDOMAIN indicates that the server you're querying is getting an authoritative answer from somewhere. Try asking for the SOA record (30.20.10.in-addr.arpa SOA) and see if the returned response provides you with a hint about which server that is. – Andrew B Jun 25 '15 at 21:30
  • @AndrewB: Well what do you know... I was testing lookups on records that were actively queried elsewhere and failing. Of course they were cached. Thanks! Could you post as an answer? – carlpett Jun 26 '15 at 6:45
1

Adding a forwarder at runtime does not automatically invalidate any queries that are currently sitting in cache for that domain. This includes negatively cached records that returned NXDOMAIN when queried. The more frequently the record is being requested, the higher the probability that the record has been cached recently.

If it's critical that the forwader change take effect immediately, the change should be accompanied by a cache purge of all records beneath that scope. It's still possible to confirm whether the change was successful without a cache purge, but you'll need to look at the returned TTL to verify that the response did not come from cache. In a pinch, you can add a fresh record on the authoritative server that you know will not be in cache.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.