I'm having this peculiar issue with Microsoft DNS.

Basically, we have domain.com that's a split horizon setup (external public DNS and internal DNS are both authoritative for separate zones), don't ask me why, it was like this when I got here.

In this AD we have 3 domain controllers, serving as DNS servers for the internal zones. On top of this, we have 2 DNS servers that forwards queries to these AD servers, and cache the results.

Additionally, we have another domain, example.com that's only in our external public DNS servers.

Now to the problem; AD servers have taken an issue with the name subdomain.example.com. The return queries with "domain name can't be found", as an authoritative server does when it doesn't have a record. However, the DNS forwarders for clients do resolve the query.

Externally everything works fine, subdomain.example.com resolves as it should to a CNAME for www3.domain.com

However, the problem is not with the whole zone, it's only with that specific subdomain. www.example.com resolves both internally and externally as a CNAME for www3.domain.com.

So, how can a DNS server that's not authoritative for a zone reply that a record can't be found?

As a workaround, I created a new zone for subdomain.example.com and added an A record that's identical with the one for www3.domain.com. And an hour later this record was gone?

I'm close to giving up and becoming a goat farmer. :)

  • Can you please share with us the configurations?
    – Tommiie
    Sep 12, 2018 at 12:46
  • Configurations of what exactly? The DNS zones?
    – Stuggi
    Sep 12, 2018 at 13:09
  • DNS zones and configurations of how the DNS servers are configured on the different domain controllers.
    – Tommiie
    Sep 12, 2018 at 13:12
  • I'm having trouble picturing your DNS server flow from the description. Any way you could include a diagram? Sep 28, 2018 at 16:22

1 Answer 1


I'm having trouble understanding your flow from the description but...

I would encourage you to have separate recursive and authoritative servers for your domain on the external side and have the internal DCs point to the external recursive servers with server forwarding.

DNS server flow

This setup is commonly referred to as split DNS. One advantage is that you can force internal clients to respond to certain addresses differently than external clients. The other advantage is you can more easily troubleshoot the flow of DNS.

To answer your question, a server that's not authoritative for a zone can say the record is not found if it couldn't find an authoritative answer for the zone. You may have a problem with your DC DNS being unable to perform recursive look ups. Ensure that the server forwarding on the DCs is enabled and goes to the recursive DNS servers. Then make sure the Recursive servers utilize the Global Hints correctly.

You can play around with NSlookup, setting the server with server = IP command and testing each server in turn for what it can see.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.