1

This relates to a forward lookup zone added to a Windows DNS server. The zone allows machines to connect directly to a local email server when connected to the LAN. The same address resolves to the external IP when the machines are connected outside the network.

For machines that are members of the domain and connected on the LAN, the forward lookup zone works fine and the LAN IP is returned. However, for machines not on the domain, the same DNS query against the same DNS server resolves to the external IP (non-authoritative). The Windows domain is ad.zxy.com and the forward lookup zone is mailserver.zxy.com.

We need both domain and non-domain machines to receive the same local IP. Any ideas?

Lookup from domain machine:

nslookup
Default Server:  FI-SVR04-DC.ad.zxy.com
Address:  192.168.30.5

> mailserver.zxy.com
Server:  FI-SVR04-DC.ad.zxy.com
Address:  192.168.30.5

Name:    mailserver.zxy.com
Address:  192.168.30.3

Lookup from non-domain machine:

nslookup
Default Server:  FI-SVR04-DC.ad.zxy.com
Address:  192.168.30.5

> mailserver.zxy.com
Server:  FI-SVR04-DC.ad.zxy.com
Address:  192.168.30.5

Non-authoritative answer:
Name:    mailserver.zxy.com
Address:  xx.xx.182.17

DNS entry for mailserver.zxy.com

nslookup from non-domain with set debug From non-domain machine

set debug mailserver.zxy.com Server: FI-SVR04-DC.ad.zxy.com Address: 192.168.30.5

Got answer: HEADER: opcode = QUERY, id = 8, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 1, authority records = 3, additional = 0

QUESTIONS:
    mailserver.zxy.com, type = A, class = IN
ANSWERS:
->  mailserver.zxy.com
    internet address = xx.xx.182.17
    ttl = 14389 (3 hours 59 mins 49 secs)
AUTHORITY RECORDS:
->  zxy.com
    nameserver = ns1.hosting-services.net.au
    ttl = 86389 (23 hours 59 mins 49 secs)
->  zxy.com
    nameserver = ns2.hosting-services.net.au
    ttl = 86389 (23 hours 59 mins 49 secs)
->  zxy.com
    nameserver = ns3.hosting-services.net.au
    ttl = 86389 (23 hours 59 mins 49 secs)

Non-authoritative answer:

Got answer: HEADER: opcode = QUERY, id = 9, rcode = NOERROR header flags: response, auth. answer, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0

QUESTIONS:
    mailserver.zxy.com, type = AAAA, class = IN
AUTHORITY RECORDS:
->  mailserver.zxy.com
    ttl = 3600 (1 hour)
    primary name server = fi-svr04-dc.ad.zxy.com
    responsible mail addr = hostmaster.ad.zxy.com
    serial  = 3
    refresh = 900 (15 mins)
    retry   = 600 (10 mins)
    expire  = 86400 (1 day)
    default TTL = 3600 (1 hour)

Name: mailserver.zxy.com Address: xx.xx.182.17

|improve this question
  • There are no conditional forwarders. – Troy May 13 at 17:28
  • 1
    Obviously this is not normal behavior based on your description. Therefore, we have to determine where you have gone wrong. In order to do that, you have to show us exactly what you are doing and seeing. We can’t tell you ANYTHING about your problem based on the details you provided. How do you KNOW the things you are telling us? How are you performing a DNS lookup? How do you KNOW you are querying the proper DNS server? How is the actual zone and A record configured? Provide screenshots and output of commands you are using to prove your point. – Appleoddity May 13 at 18:09
  • The FQDN of the DNS server is different for domain joined and non-domain joined machines, even though the ip address is the same. Are you using DNS Policies with the DNS server? – joeqwerty May 13 at 20:04
  • docs.microsoft.com/en-us/powershell/module/dnsserver/… – joeqwerty May 13 at 20:07
  • No domain DNS policies. A new domain setup for a 10 user office. Pretty standard stuff - nothing out of the ordinary. – Troy May 13 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.