1

This relates to a forward lookup zone added to a Windows DNS server. The zone allows machines to connect directly to a local email server when connected to the LAN. The same address resolves to the external IP when the machines are connected outside the network.

For machines that are members of the domain and connected on the LAN, the forward lookup zone works fine and the LAN IP is returned. However, for machines not on the domain, the same DNS query against the same DNS server resolves to the external IP (non-authoritative). The Windows domain is ad.zxy.com and the forward lookup zone is mailserver.zxy.com.

We need both domain and non-domain machines to receive the same local IP. Any ideas?

Lookup from domain machine:

nslookup
Default Server:  FI-SVR04-DC.ad.zxy.com
Address:  192.168.30.5

> mailserver.zxy.com
Server:  FI-SVR04-DC.ad.zxy.com
Address:  192.168.30.5

Name:    mailserver.zxy.com
Address:  192.168.30.3

Lookup from non-domain machine:

nslookup
Default Server:  FI-SVR04-DC.ad.zxy.com
Address:  192.168.30.5

> mailserver.zxy.com
Server:  FI-SVR04-DC.ad.zxy.com
Address:  192.168.30.5

Non-authoritative answer:
Name:    mailserver.zxy.com
Address:  xx.xx.182.17

DNS entry for mailserver.zxy.com

nslookup from non-domain with set debug From non-domain machine

set debug mailserver.zxy.com Server: FI-SVR04-DC.ad.zxy.com Address: 192.168.30.5

Got answer: HEADER: opcode = QUERY, id = 8, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 1, authority records = 3, additional = 0

QUESTIONS:
    mailserver.zxy.com, type = A, class = IN
ANSWERS:
->  mailserver.zxy.com
    internet address = xx.xx.182.17
    ttl = 14389 (3 hours 59 mins 49 secs)
AUTHORITY RECORDS:
->  zxy.com
    nameserver = ns1.hosting-services.net.au
    ttl = 86389 (23 hours 59 mins 49 secs)
->  zxy.com
    nameserver = ns2.hosting-services.net.au
    ttl = 86389 (23 hours 59 mins 49 secs)
->  zxy.com
    nameserver = ns3.hosting-services.net.au
    ttl = 86389 (23 hours 59 mins 49 secs)

Non-authoritative answer:

Got answer: HEADER: opcode = QUERY, id = 9, rcode = NOERROR header flags: response, auth. answer, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0

QUESTIONS:
    mailserver.zxy.com, type = AAAA, class = IN
AUTHORITY RECORDS:
->  mailserver.zxy.com
    ttl = 3600 (1 hour)
    primary name server = fi-svr04-dc.ad.zxy.com
    responsible mail addr = hostmaster.ad.zxy.com
    serial  = 3
    refresh = 900 (15 mins)
    retry   = 600 (10 mins)
    expire  = 86400 (1 day)
    default TTL = 3600 (1 hour)

Name: mailserver.zxy.com Address: xx.xx.182.17

Improve this question
14
  • There are no conditional forwarders.
    – Troy
    May 13 '19 at 17:28
  • 1
    Obviously this is not normal behavior based on your description. Therefore, we have to determine where you have gone wrong. In order to do that, you have to show us exactly what you are doing and seeing. We can’t tell you ANYTHING about your problem based on the details you provided. How do you KNOW the things you are telling us? How are you performing a DNS lookup? How do you KNOW you are querying the proper DNS server? How is the actual zone and A record configured? Provide screenshots and output of commands you are using to prove your point.
    – Appleoddity
    May 13 '19 at 18:09
  • The FQDN of the DNS server is different for domain joined and non-domain joined machines, even though the ip address is the same. Are you using DNS Policies with the DNS server?
    – joeqwerty
    May 13 '19 at 20:04
  • docs.microsoft.com/en-us/powershell/module/dnsserver/…
    – joeqwerty
    May 13 '19 at 20:07
  • No domain DNS policies. A new domain setup for a 10 user office. Pretty standard stuff - nothing out of the ordinary.
    – Troy
    May 13 '19 at 20:13
1

Sorry for the late response and just in case someone may be facing a similar issue, it turned out to be Avast "Real Site" installed on the non-domain machines that was causing this unexplained and inconsistent behavior. Thanks

Improve this answer
0

I had exactly the same problem. Once I disabled the Avast Real Site submodule, the DNS query returned the same result as queries from domain computers.

Thanks Troy

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.