I have a user on a Windows 10 machine that is getting very odd responses to a DNS query. I'm running bind9 and using zones to separate internal and external queries based on subnets and it works perfectly for every other user but this one laptop.
When I run an nslookup on their machine for the mail server, I am getting the external IP (non-authorative):
C:\Users\franc>nslookup mail.example.com.
Server: ns2.example.com
Address: 10.0.0.60
Non-authoritative answer:
Name: mail.example.com
Address: 163.237.18.117
However, when I enabled query logging on the server, I see that bind is correctly seeing the query as coming from the internal zone:
client 10.0.0.193#52796: view internal: query: 60.0.0.10.in-addr.arpa IN PTR + (10.0.0.60)
client 10.0.0.193#52800: view internal: query: mail.example.com IN A + (10.0.0.60)
client 10.0.0.193#52802: view internal: query: mail.example.com IN AAAA + (10.0.0.60)
If I connect the laptop to an external network connection, the external DNS works and of course the mail client works again.
I tried clearing the DNS cache on the machine, no change on the answer. As far as I can tell the server is correctly answering the query as an internal view, so I have no idea where Windows is getting the external view answer. It isn't restricted to just the mail address - any internal name lookup is returning an external view answer.
