I am managing a pair of Windows 2008 R2 Enterprise SP1 domain controllers with AD integrated DNS. We occasionally see member servers in the local domain intermittently fail to resolve an internet DNS name which the business requires use of (xmlgate.hpi.co.uk)

Restarting the DNS service on our domain controller(s) will then allow clients (or the DC itself) to correctly get a recursive IP for the xmlgate name.

The DCs are fully up to date with Windows Updates, and we have also patched with this DNS specific hotfix from microsoft

which has not altered the behavior of our environment. DNS is set up with no forwarders, we instead have the DCs going out to the root hint servers.

Can anyone suggest how I get to the bottom of this, I captured NSLOOKUP debug records during my last outage, which I have not yet posted due to the detail, but I can add these if ok any use.

Here is an extract of my DNS debug log with a failed query.

03/12/2014 15:35:20 0A48 PACKET  0000000002F76310 UDP Rcv 10.xxx.xxx.xx1    af8c   Q [0001   D   NOERROR] A      (7)xmlgate(3)hpi(2)co(2)uk(0)
03/12/2014 15:35:20 0A48 PACKET  0000000002F76310 UDP Snd 10.xxx.xxx.xx1    af8c R Q [8281   DR SERVFAIL] A      (7)xmlgate(3)hpi(2)co(2)uk(0)

Thanks for any help offered.

  • What is configured as first DNS server on the network adapter from the server itself? – duenni Sep 18 '15 at 10:41
  • Have you tried a simple ipconfig /flushdns to clear the cache – user312030 Sep 18 '15 at 10:56
  • @dunenni - the first domain controller uses the IP address of the second domain controller as its preferred DNS, and vice versa. The alternate IP for each DNS is the loopback IP. This was as per the best practice analyzer in the server manager. – AndyR Sep 18 '15 at 11:42
  • @Liam I have run a DNSCMD /CLEARCACHE on each DNS server which also fixes the symptoms. I cant recall trying to clear the cache on a workstation or member server during an outage using the IPCONFIG /clearcache. – AndyR Sep 18 '15 at 12:27
  • Can you check HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters for IsSlave – Drifter104 Sep 18 '15 at 16:44

Is IPv6 enabled or disabled on your DNS server?
There is a hotfix to fix intermittent external failures when IPv6 is disabled.
The date on DNS.EXE in this hotfix is newer than what is listed in the hotfix you mentioned having already applied.

| improve this answer | |
  • Thanks @Craig620, we have disabled IPv6. I applied the hotfix after going through our change control and waited for another incident to happen, but it didnt seem to fix our fault. I might try uninstall the hotfix and enable ipv6..after that Im going to microsoft for help! – AndyR Nov 5 '15 at 11:23

After implementing various hotfixes from microsoft and testing each, the one which seemed to solve my problem was


Im not sure why changing the cache from 24 to 48 hours fixes resolution issues for a DNS record with a TTL of only an hour, but my issue has gone.

Thanks for any help offered.

| improve this answer | |

We always delete all forwarders and use our Windows Servers as DNS Servers, which means they communicate directly with the root authorities.

This is likely a router issue with large udp packets, you can fix it by disabling EDNS

dnscmd /config /EnableEDNSProbes 0

Why use root hints? Because they don't manipulate DNS, they don't invalidate RFC (nxdomain comcast) and you control your cache.

| improve this answer | |
  • Querying root authorities directly is not recommended. You should always have forwarders set up. Usually they should point to ISPs DNS servers. – iPath Sep 18 '15 at 16:20
  • According to you?. – Jacob Evans Sep 18 '15 at 16:22
  • 1
    @iPath - Where are you getting the idea that querying the root servers directly isn't recommended? Can you link to/cite your source? – joeqwerty Sep 18 '15 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.