DNS issues

[adfreek]

In my test lab, we have a native 2003 server environment. I have about 5 server 2003 virtual machines built and in the DNS settings, I added the static IP for my ISP dns servers. This allowed all the machines to successfully get onto the internet and use Windows Update. I then installed DNS on one of the servers and pointed all my other boxes to this internal DNS server. I went into the properties of the dns server and under "Forwarders", simply added the two public IP addresses of my ISP dns servers. Now none of my servers can hit the internet? I know it's not a firewall issue because I have a rule set up in checkpoint to allow the 172.16.210.x network outbound dns access to those two public IP's, plus, they were able to hit the internet without issues when they were hard coded with the ISP dns servers.

When I do an nslookup, it points to the default internal MS dns server. But if I query something like

http://www.espn.com,

it fails. What am I missing?

Thanks

 

[deeno]

Not sure if this will help, but make sure your internal DNS server has a valid PTR record for the interanl DNS server. This would be in the Reverse Lookup Zone of your DNS Server, in the x.x.x.in-addr.arpa section.

For example, if your internal DNS server has an internal address of 10.1.1.100, with a subnet of 255.255.255.0, and a name of ns1, you need to have a PTR (pointer) record in the 1.1.10.in-addr.arpa section of the DNS server. This record would have the Host IP number set to 100 and the host name set to ns1.

Hope this helps. Keep us updated...

-deeno

 

[adfreek]

actually I should have added that I did indeed already create the reverse zone and a record for the DNS server. Still having the issue

thanks

 

[wbg34]

Go to the following FAQ faq96-3017 and follow the instructions for removing the root zone. Make sure there is nothing that you missed on the rest of the FAQ.

 

[adfreek]

still no luck. This is a 2003 DNS server and under forward lookup zones, there is no "." root zone to delete. All the remaining steps in the FAQ were already done. Let me add that when I do a recursive query under the "monitoring" tab of the DNS server properties, it fails. ?????

I don't get it

 

[ricpinto]

1.Who's doing the NAT? Is it the server, the router or firewall?

2.Can you ping server name and ip addresses from one server to another?

3.Can you post all the server's ipconfig/all?

4.Any diagram on how are they connected?

Internet-> router(NAT)->firewall->???

 

[adfreek]

I figured it out. See Q article Q828731. It has to do with UDP DNS packets that exceed 512 bytes which were getting dropped by my firewall. There is a command to disable EDNSO (Extension mechanisms for DNS) which is a new feature in 2003 DNS.