0

I have a domain controller which is assigned as a primary DNS server to clients via DHCP (also on this server, Windows Server 2012). We have several servers that have both internal and external IP addresses, such as our file sever and our mail server. When client computers attempt to connect to these servers by their FQDN, they receive a DNS error. Pinging the FQDN on the affected machines reveals that they're attempting to access them via their external IP addresses, even though ipconfig /all shows they're using the DNS server.

Disconnecting and reconnecting to the network will cause them to start resolving successfully again for a while. I don't have any conditional forwarders set up on the DNS server.

Any idea what's going on here?

  • Are you assigning any other DNS servers to the clients? – joeqwerty Aug 1 '16 at 16:04
  • The clients are assigned our ISP's public DNS servers as a failover measure. The part I don't understand is why they're reporting using our internal DNS server when it seems like they must be grabbing the IP from the external server? And why they're using the external server in the first place. – garthand Aug 1 '16 at 17:03
  • 5
    The first thing I would do would be to remove the ISP DNS servers from the clients. AD members should only use the AD DNS server(s) for DNS. The ISP DNS servers may be causing the problem and it sounds like they're masking a potential issue with your AD DNS server. Eliminating them (along with being best practice) will let you hone in on any internal DNS server issues as well eliminating the existing issue. – joeqwerty Aug 1 '16 at 17:23
  • I removed the ISP DNS servers from all the clients. I'll have to see what happens. Thanks again for your advice! – garthand Aug 1 '16 at 19:52
3

The first thing I would do would be to remove the ISP DNS servers from the clients. AD members should only use the AD DNS server(s) for DNS. The ISP DNS servers may be causing the problem and it sounds like they're masking a potential issue with your AD DNS server. Eliminating them (along with being best practice) will let you hone in on any internal DNS server issues as well eliminating the existing issue.

1

Huge thanks to joeqwerty 23! it looks like the issue was clients having multiple DNS servers assigned. Whenever ours took just a moment longer to respond than usual, they would start using one of the failover servers. Removing them has fixed the issue.

  • 1
    Glad you got it resolved. – joeqwerty Aug 4 '16 at 13:27
  • 1
    @garthand - glad yuo've got a fix. Don't forget to mark Joe's answer as "Accepted". – mfinni Aug 4 '16 at 13:31
  • @mfinni I would but unfortunately it won't let me mark a comment as an answer (unless there's some hidden way to do so) – garthand Aug 4 '16 at 14:01
  • Joe's answer is right there on the page, as an answer. – mfinni Aug 4 '16 at 18:31
0

You most likely don't need to reference your servers by their external IPs from the inside. I would just delete the DNS entries for the public addresses on your local DNS server(s). If you absolutely need to access them by the external IP address you can use NAT reflection on your router to redirect traffic back to your internal network.

I assume you probably have other name servers setup from the outside, most likely provided by your domain registrar, to handle name resolution from the public space. Which would make it pointless to have public IP entries on your local name servers.

You can always use DNS delegation to setup split DNS. https://technet.microsoft.com/en-us/library/cc771640(v=ws.11).aspx

  • I should have been clearer: my local DNS servers dont' have entries for the public addresses, only the internal addresses. – garthand Aug 1 '16 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.