I work with an isolated/airgapped global network with several redundant domain controllers which also act as DNS servers. My question is, I hope, pretty simple, but I seem to be having a hard time finding anything on Google that applies to our setup.
Is there a best practice for dealing with external internet DNS requests coming from systems on an isolated network?
We recently identified that a large portion of our network bandwidth is being utilized by DNS, specifically UDP traffic on port 53 between the different DNS servers. We can verify this by enabling DNS debug logging where we see hundreds of megabytes of DNS traffic every hour on all of our DNS servers. We know the main culprit to be McAfee's GTI/Artemis protocol where they try to send hashed file data to avts or avqs.mcafee.com via DNS requests. We're getting the McAfee problem fixed by dealing with the McAfee software on our network, but I was concerned with how the DNS requests are being forwarded between our different DNS servers. It appears that our DNS servers are just forwarding the requests for any external site to a different DNS server in our network. This process appears to last forever, or at least for a very long time (more than 30 minutes for one specific request that I tracked through the DNS debug logs). The request gets sent from Server 1 -> Server 2 -> Server 3 -> Server 1 etc. I'm trying to get together some data to propose a change to people in charge of configuration management, because right now it appears that something is clearly not configured properly.
Using Windows Server 2008 R2.