In what circumstances would a DNS server request timeout when the forwarders already have the answer? For example, there appears to be a domain that I assume is having DNS issues at the moment us.army.mil. If I hit the forwarders directly with nslookup for type=mx then I get a response right away. If I hit our DNS server though with the same request it takes more than 2 seconds and times out or when I extend timeout to 10 seconds it fails. If I try multiple times it eventually returns a response.

It is my understanding that our DNS server should be sending requests for external domains to the forwarders and getting response if available. The log shows the first forwarder being hit and then after 3 seconds the second forwarder is attempted. How does my direct request to the forwarder not have problems while our server's does?

  • does your dns server do any recursion on its own, or is it configured to forward all requests? – pete Dec 1 '15 at 17:38
  • If the DNS server is configured to use forwarders then it won't perform recursion, it will forward the request to the forwarders and wait for the forwarders to provide an answer. – joeqwerty Dec 1 '15 at 17:43
  • Based on what I see in the log, it is forwarding all external requests. I see request come in from another one of our servers, request to forwarder and then response. If both forwarders timeout I sometimes see requests to another IP that I assume is a root hint server but the end result there is a serverfail response back to the original requester. If there is something else to consider here let me know. – dmr83457 Dec 1 '15 at 17:47
  • @joeqwerty i ask because its not always the case; i'm not familiar with windows' server in particular, but i know some are capable of forwarding specific zones verses all zones, and some will attempt their own recursion if the forwarders fail. – pete Dec 1 '15 at 17:55
  • 1
    @dmr83457: Try different forwards to see if you get different results. Remove your current forwarders and add Google forwarders ( and – joeqwerty Dec 1 '15 at 18:04

When you cascade DNS recursing servers and introduce forwarders, that is the kind of problem you meet.

One of your DNS servers is not answering correctly. All but authoritative servers can have a cache.

Two possibilities:

  • One of the authoritative server is not answering, but one of your cache has the good answer.
  • One of your forwarder/recursive server has a wrong entry in cache (can be a NS record, a CNAME, a delegation, ...).

dig command can help you know exactly which server is behaving incorrectly (but its output should be read carefully):

dig myhost @myfirstforwarder
dig myhost @myrealrecursor
dig -t NS myhost
dig -t any @authserver1
dig -t any @authserver2

and so on.

The trick is: don't put forwarders in place: only recursive servers and authoritative ones. Keep It Simple Stupid.

  • +1 for giving the commands to troubleshoot futher – Mark Henderson Dec 2 '15 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.