I have a Windows Server 2012 domain controller with DNS Server role installed. I configured several DNS servers as forwarders and that's working absolutely fine. All DNS requests are resolved.

Now I noticed in my firewall logs, that my DNS server permanently tries to reach gtld-servers.net on port 53, which is blocked by the firewall. Although there are none of these IP's configured as forwarders! Can you tell me, why it does that? I don't see any reason why.

IP's it tries to reach on port 53, but which are blocked:

  • Why are you blocking access to authorative nameservers?
    – Torin
    Feb 19 '18 at 11:48
  • Because I have my own dns servers defined as forwarders.I just want to understand why it tries to reach dns servers which aren't configured as forwarders? It didn't do that in the past, I see those logs for the first time. Malware?
    – Alex_90
    Feb 19 '18 at 11:53
  • Is it possible that one or more of your configured forwarders don't perform recursion?
    – joeqwerty
    Feb 19 '18 at 16:11
  • How can I find that out?
    – Alex_90
    Feb 20 '18 at 14:22
  • The thing is, the whole problematic started two weeks ago. Before, we never had that problem. So something changed...
    – Alex_90
    Feb 20 '18 at 14:29

By default, there is an option to Use root hints if no forwarders are available, which you can turn off, if you only want the forwarders to be used.

Root hints are only used if forwarders are not configured or fail to respond. So the reason why it tries to reach other servers, might be that it that the forwarders fail to respond (in time) or fail to lookup some name.

To find out what's going on, you can turn on Debug Logging for the DNS server or use a packet analyzer like Wireshark.

  • I can analyze the packets, you are right. But I'm still wondering what happened in the meantime. Two weeks ago, everything was fine. It started on February 7, 2018
    – Alex_90
    Feb 21 '18 at 8:01
  • If you can see what computer and port it's coming from, you should be able to see which program it's from. Have you figured that out?
    – PatrikN
    Feb 21 '18 at 15:18
  • Sorry? the packets are originated at the domaincontroller/dns server
    – Alex_90
    Feb 22 '18 at 15:08
  • You can try Wireshark then and hopefully see the traffic and which local port it's coming from. Then you can check which program it belongs to from Cmd with Netstat -no | Find "11111" or whatever the port number is.
    – PatrikN
    Feb 22 '18 at 16:05

In the DNS Management console > server properties > Forwarders tab, you need to UNcheck the box for "Use root hints if no forwarders are available", and you need to remove all the entries in the %SYSTEMROOT%\System32\DNS\Cache.DNS file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.