DNS Issues resolving external address

[SGTRawlins]

Hello Chaps. Have been experencing a few issues when attemting to resolve SOME external address's.

Find below the configuration of two of our servers, IT145 works fine however IT76 is having isseus resolving particular address's such as

http://www.theaa.com

and

http://www.microsoft.com.

IT145 – TCP/IP and DNS Sever Configuration

NIC – TCP/IP Settings

IP Address 10.1.0.10
Subnet Mask 255.255.0.0
Default Gateway 10.1.0.254

Preferred DNS 10.1.0.10
Alternate DNS 192.168.16.1

DNS Server Settings

Forwarders 10.1.0.254

IT76 – TCP/IP and DNS Sever Configuration

NIC – TCP/IP Settings

IP Address 192.168.16.1
Subnet Mask 255.255.255.0
Default Gateway 192.168.16.254

Preferred DNS 192.168.16.1
Alternate DNS

DNS Server Settings

Forwarders 80.68.34.6 & 80.68.34.8 - these are the DNS address's of our ISP.


All you opinions are much appreicated, my knowledge of DNS is not that extensive but i will attemot to answer your questions to thier fullest. Should we change the forwarders on IT76 to tha gateway as is set on IT145?

Cheers in advnace, Robo

 

[NickFerrar]

IT76 can resolve some external DNS names though? If so it's pretty odd, you don't have zone files for the addresses it can't resolve hosted on IT76 do you? Or records in the hosts file on the IT76 for theaa.com and microsoft.com?

I'd check the DNS cache on IT76 and see if there's an invalid record there, if so the most likely culprit would be a hosts file entry.

 

[SGTRawlins]

Most websites address's resolve without issues, just a few crop up now and then, they appear to be important domains though as you can see above.

As for zone files, there are none that i can see, my consultant that was hired for the implementation of the system seems to think that there is a hardware issues with the firewall and wants to get it swapped out, we are just using a small 3com office connect. Does this seem plausable.

I am still convinced that it is a DNS issues, DNS has been playing up since they began the implementation,, firstly affecting our clients heavily and outlook was struggling to locate our exchage system, hosted on the same box as DNS Server.

Where can i find the DNS cache, what am i looking for?

 

[NickFerrar]

You can see the cache within the DNS admin MMC, it appears like a zone in itself called "Cached Lookups". Mind you stuff shouldn't stay in there long due to TTL expiry (I'm not sure though if you have the entry in a local hosts file if it's read into the cache and stays there permanently...).

In the Q&A section in Windows magazine it also mentions EDNS can cause the sort of issue you're having. Basically EDNS (Extension Mechanisms for DNS) is enabled by default in 2003 DNS and permits the use of UDP packets larger than 512KB to improve performance. Apparently most firewalls won't let UDP packets this big through so they get dropped. Personally though this sounds more like a zone transfer thing - I can't see how a resolution query could ever generate a packet as large as that (but the guy asking the question has your identical problem - some sites resolve and others don't) so maybe EDNS is related to queries.

The command to disable EDNS (if you want to test if it makes a difference) is: dnscmd /config /enableednsprobes 0
to re-enable it just use the same command with a 1 instead of the 0.

 

[markdmac]

Try creating a new DWORD in the registry under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters

Call it "EnableDnsProbes" and set the value to 0 (zero).

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[SGTRawlins]

markdmac thanks for the suggestions, we have allready made this correction to the registry as advised by mircosoft.

We have also installed several different apps that alter the NTU package size to allow larger packets to transfer through the system.

We are now waiting on a replacement firewall, dont hold out much hope for this bringing a resolution but we will wait and see.

Cheers

 

[mrscary]

Ok - here is what I would do -

On the server
Disable forwarders - let the DNS server use the root hints that come configured. Then, remove the second DNS (192.168.16.1)

On the workstations:
The only DNS server listed should be the server as configured previously.

M.

Hollingside Technologies, Making Technology work for you.

http://www.hollingside.com

(No, I am not scary at all! See

http://www.stircrazy.org)