0

I have an AD and DNS server on Server 2008 R2 (home network, nothing fancy). I used to have a secondary AD and DNS box that is currently offline - we moved, and that server was disconnected for too long to bring back online without problems. I've already removed it from both Active Directory and DNS.

We are currently using an Apple Airport Extreme router (real router crapped out and needs to be RMAed), and it's configured to distribute the server's IP address as the DNS server for DHCP clients. The DNS server is configured with the default root hints set by Windows Server.

The most recent change was the use of the server on the router for DHCP clients. Since this is a temporary router until our other one is replaced, I didn't mess with the settings until now - which means that clients either used the router for DNS or had DNS manually configured to point to the server. In both cases external DNS worked fine. Active Directory broke if I didn't manually set a client's DNS to point to the server, but other than that all was good.

Ever since I set the router to assign the server's IP as the DNS address to DHCP clients, DNS resolution is flaky as hell. It takes two or three tries before an FQDN will actually resolve to an IP address.

For instance, when I tried to run nslookup against a website I own, this happened:

C:\Users\claire>nslookup abettergeek.com
Server:  hyrule.local
Address:  192.168.1.133

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to hyrule.local timed-out

C:\Users\claire>nslookup abettergeek.com
Server:  hyrule.local
Address:  192.168.1.133

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to hyrule.local timed-out

C:\Users\claire>nslookup abettergeek.com
Server:  hyrule.local
Address:  192.168.1.133

Non-authoritative answer:
Name:    abettergeek.com
Address:  72.14.177.31

Took two tries before it finally went through external DNS.

I don't think it's the DNS server, since manually setting a client to use it for DNS didn't have this problem.

Updated debug info:

C:\Users\claire>nslookup
Default Server:  hyrule.local
Address:  192.168.1.133

> set debug
> aol.com.
Server:  hyrule.local
Address:  192.168.1.133

DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
*** Request to hyrule.local timed-out
> aol.com.
Server:  hyrule.local
Address:  192.168.1.133

DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 5, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        aol.com, type = AAAA, class = IN
    AUTHORITY RECORDS:
    ->  aol.com
        ttl = 298 (4 mins 58 secs)
        primary name server = dns-01.ns.aol.com
        responsible mail addr = hostmaster.aol.net
        serial  = 470952482
        refresh = 86400 (1 day)
        retry   = 180 (3 mins)
        expire  = 2592000 (30 days)
        default TTL = 300 (5 mins)

------------
*** Request to hyrule.local timed-out
> aol.com.
Server:  hyrule.local
Address:  192.168.1.133

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 6, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 5,  authority records = 0,  additional = 0

    QUESTIONS:
        aol.com, type = A, class = IN
    ANSWERS:
    ->  aol.com
        internet address = 149.174.110.102
        ttl = 3591 (59 mins 51 secs)
    ->  aol.com
        internet address = 64.12.79.57
        ttl = 3591 (59 mins 51 secs)
    ->  aol.com
        internet address = 149.174.107.97
        ttl = 3591 (59 mins 51 secs)
    ->  aol.com
        internet address = 207.200.74.38
        ttl = 3591 (59 mins 51 secs)
    ->  aol.com
        internet address = 64.12.89.186
        ttl = 3591 (59 mins 51 secs)

------------
Non-authoritative answer:
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 7, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        aol.com, type = AAAA, class = IN
    AUTHORITY RECORDS:
    ->  aol.com
        ttl = 291 (4 mins 51 secs)
        primary name server = dns-01.ns.aol.com
        responsible mail addr = hostmaster.aol.net
        serial  = 470952482
        refresh = 86400 (1 day)
        retry   = 180 (3 mins)
        expire  = 2592000 (30 days)
        default TTL = 300 (5 mins)

------------
Name:    aol.com
Addresses:  149.174.110.102
          64.12.79.57
          149.174.107.97
          207.200.74.38
          64.12.89.186

Some more info, via interactive + debug:

C:\Users\claire>nslookup
Default Server:  hyrule.local
Address:  192.168.1.133

> set debug
> aol.com
Server:  hyrule.local
Address:  192.168.1.133

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 2, rcode = NXDOMAIN
        header flags:  response, auth. answer, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        aol.com.hyrule.local, type = A, class = IN
    AUTHORITY RECORDS:
    ->  hyrule.local
        ttl = 3600 (1 hour)
        primary name server = holodrum.hyrule.local
        responsible mail addr = hostmaster.hyrule.local
        serial  = 4921
        refresh = 900 (15 mins)
        retry   = 600 (10 mins)
        expire  = 86400 (1 day)
        default TTL = 3600 (1 hour)

------------
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 3, rcode = NXDOMAIN
        header flags:  response, auth. answer, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        aol.com.hyrule.local, type = AAAA, class = IN
    AUTHORITY RECORDS:
    ->  hyrule.local
        ttl = 3600 (1 hour)
        primary name server = holodrum.hyrule.local
        responsible mail addr = hostmaster.hyrule.local
        serial  = 4921
        refresh = 900 (15 mins)
        retry   = 600 (10 mins)
        expire  = 86400 (1 day)
        default TTL = 3600 (1 hour)

------------
DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
*** Request to hyrule.local timed-out
> aol.com
Server:  hyrule.local
Address:  192.168.1.133

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 6, rcode = NXDOMAIN
        header flags:  response, auth. answer, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        aol.com.hyrule.local, type = A, class = IN
    AUTHORITY RECORDS:
    ->  hyrule.local
        ttl = 3600 (1 hour)
        primary name server = holodrum.hyrule.local
        responsible mail addr = hostmaster.hyrule.local
        serial  = 4921
        refresh = 900 (15 mins)
        retry   = 600 (10 mins)
        expire  = 86400 (1 day)
        default TTL = 3600 (1 hour)

------------
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 7, rcode = NXDOMAIN
        header flags:  response, auth. answer, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        aol.com.hyrule.local, type = AAAA, class = IN
    AUTHORITY RECORDS:
    ->  hyrule.local
        ttl = 3600 (1 hour)
        primary name server = holodrum.hyrule.local
        responsible mail addr = hostmaster.hyrule.local
        serial  = 4921
        refresh = 900 (15 mins)
        retry   = 600 (10 mins)
        expire  = 86400 (1 day)
        default TTL = 3600 (1 hour)

------------
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 8, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 5,  authority records = 0,  additional = 0

    QUESTIONS:
        aol.com, type = A, class = IN
    ANSWERS:
    ->  aol.com
        internet address = 149.174.110.102
        ttl = 3561 (59 mins 21 secs)
    ->  aol.com
        internet address = 64.12.79.57
        ttl = 3561 (59 mins 21 secs)
    ->  aol.com
        internet address = 207.200.74.38
        ttl = 3561 (59 mins 21 secs)
    ->  aol.com
        internet address = 149.174.107.97
        ttl = 3561 (59 mins 21 secs)
    ->  aol.com
        internet address = 64.12.89.186
        ttl = 3561 (59 mins 21 secs)

------------
Non-authoritative answer:
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 9, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
        aol.com, type = AAAA, class = IN
    AUTHORITY RECORDS:
    ->  aol.com
        ttl = 267 (4 mins 27 secs)
        primary name server = dns-01.ns.aol.com
        responsible mail addr = hostmaster.aol.net
        serial  = 470952480
        refresh = 86400 (1 day)
        retry   = 180 (3 mins)
        expire  = 2592000 (30 days)
        default TTL = 300 (5 mins)

------------
Name:    aol.com
Addresses:  149.174.110.102
          64.12.79.57
          207.200.74.38
          149.174.107.97
          64.12.89.186
  • Whether the DNS server is set automatically or manually shouldn't have any impact on the client. You said you were using root hints on the server. Have you tried specifying external forwarders instead? Sometimes the recursive lookup can take a bit longer and this could account for the noted delay. – learley Feb 18 '16 at 17:30
  • That's a strange server name. hyrule.local. It should be something like server.hyrule.local. What's the FQDN of your AD domain? Also run nslookup in interactive mode with the debug option and run your query. Then post the full result in your question. – joeqwerty Feb 18 '16 at 17:30
  • Added requested info - I have hyrule.local set as my search domain for DHCP clients in the router config - I'm wondering if that's part of the problem. I'm not sure WHY it's hyrule.local instead of holodrum.hyrule.local (server's FQDN) - I didn't change much from the default setup options for both active directory and DNS. – ClairelyClaire Feb 18 '16 at 17:47
  • If the DHCP clients are AD domain clients then you don't need to configure the search domain via DHCP. They'll all use their AD DNS suffix. One more thing, run your query as a fully qualified query; aol.com. (notice the dot?). Without the trailing dot(.) your query is unqualified and that's why nslookup is appending the client DNS suffix to the query. Do that and post those results in your question. – joeqwerty Feb 18 '16 at 17:59
  • Added - took three tries to get back name resolution. – ClairelyClaire Feb 18 '16 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.