DNS Changes don't stick

[rjs]

Windows 2000 server. It is a member server, no Active directory. It is a public DNS server using standard primary DNS. Been installed and working for at least 2 years.

In the past few weeks, host and other records will change or revert to really old entries for no apparant reason. This happens randomly meaning a random domain (out of about 100) will have a change. No one else has access to the server, except for Web related FTP accounts.

No other problems are occuring on the server.

Anyone with ANY ideas would be appreciated.

 

[brontosaurus]

is this box acting as a secondary to any other nameservers?

 

[rjs]

No it is the primary. I have another box that is the secondary.

 

[brontosaurus]

are you allowing Dynamic Updates? What about zone transfers, how are they set up? Are you allowing recursive queries from the internet?

 

[rjs]

I don't see anywhere that has a dynamic updates setting. I think this is only for Active Directory which is not installed on this server.

It does allow zone transfers (no restrictions), but I believe this only applies to it sending transfers to other servers, not getting transfers. Am I mistaken?

I found an option to "Disable Recursion" and it is NOT checked. I assume this means it allows recursion.

 

[brontosaurus]

Dynamic Updates can be found on the properties of your Forward Lookup Zones.
What I'm trying to do is rule out the possibility that someone is attacking you via DNS Spoofing. You should restrict zone transfers to servers that are acting as secondaries as a precaution. Unfortunately, if you're acting as a nameserver for internet hosts, disabling recursion would probably be a bad idea, although it would be a big deterrent to spoofing.

Anyway, when these changes occur, do you recognize the IP's as valid for some other resource you're authoritative for, or are they totally unknown?

 

[rjs]

The changes are always either old names and numbers from that zone or occasionally from another zone that is also on this server. That is why I don't think it is a "hack".

In looking through the config, there is an option to load zone data on startup from: AD and Reg
From file
From Reg
It is set to AD and Reg (probably the default) even though it is not running AD. Do you know where in the registry it is storing the zones? Maybe that is corrupt.

BTW, thanks for helping on this.

 

[brontosaurus]

I would change that to "From File", name it as you choose, and work with that. It will store the file(s), by default in C:\%Systemroot%\system32\dns. I find it's much easier to manage this way.