I've Windows 2016 DC on domain Super.Dom. I've setup conditional forwarder in DNS for domain test.dom. Now this test.dom is a separate domain and so it has multiple other domains setup on it. Including some external domain external.com.

For some reason queries for external.com return results from "local" subnets instead of using external forwarders (

So it would seem DNS is using conditional forwarder of test.dom to deliver answer for external.com which is weird (at least unexpected). Is that standard? How can i force Windows DNS to only use conditional forwarding for test.dom (and maybe subdomains of test.dom) and not return anything else from other domains?

  • You have already confirmed that the DC with the conditional forwarder returns the correct results when queried using nslookup. A simple packet capture on the client returning the unexpected results would most likely answer your question.
    – Greg Askew
    Jun 10 '17 at 17:45

I don't think it is your conditional forwarder that is causing this behaviour. if you have configured the conditional forwarder to forward any query for the domain test.dom to another set of DNS servers then that is the only domain it will resolve using this conditional forwarder.

On your super.dom DNS servers what entries do you have in the forwarders tab? do you have any entries in there? if you have entries like then it is this entry that will try to resolve external.com and not your conditional forwarder. alternatively if you don't have any entries in you forwarders tab then your super.dom DNS servers will be using RootHints to try and resolve external.com

if your Super.dom DNS servers don't have internet access then you can edit the forwarders tab to send all requests that the DNS server cant resolve to another DNS Server that does have internet access.

  • Well i always thought that conditional forwarder works as you describe but what I am seeing is that computer on the network has our DC as DNS/WINS server and still it gets diff ip address than I get by nslookup by querying our DC. The only thing that i can think of is that this "network" is doing something fancy to takeover requests for certain dns records and apply it's own set of rules. That whole network belongs to "test.dom" so it's entirely possible however I am not sure how...
    – MadBoy
    Jun 10 '17 at 13:11
  • If i do tests of nslookup/ping from DC itself it delivers results, the same I get at home, but the computer that is joined to super.dom with DNS/WINS set to super.dom, being on network of test.dom is getting different results. Which i am not sure why... if it's not by using conditional forwarder with subnet prioritization of some sort.
    – MadBoy
    Jun 10 '17 at 13:12
  • My forwarders for DNS servers are set to only. And root hints are left at their defaults.
    – MadBoy
    Jun 10 '17 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.