Newbie question: What can change a DNS?

[lb63640]

We recently had an odd experience with our W2K server/sp4 that serves as our DC and Exchange server.

All of a sudden, after an ISP rep visited our office to verify the block of IP addresses we were assigned, email to domains outside our own started getting logjammed in the SMTP queue. Incoming mail from any domain was fine.

It turns out that our primary and secondary DNS entries were changed to something else. When this was discovered and changed back to the appropriate entry, all was well.

How can this happen, and how can we prevent from it repeating? All users at that location swear they never go near the server, let alone touch it. The ISP rep says he did nothing. I know that neither myself nor my supervisor made a change...so I'm scratching my head.

Any input appreciated!

 

[minxca]

someone must changed it. yeah they swear never go near that server but they used admin toolor or via TS to change.

 

[GlenJohnson]

Did ya do a re-boot? It's possible that you have a hosts file that has them listed backwords, and after a re-boot, the hosts file will load first. Just a thought.

Glen A. Johnson
If you're a kid at heart, check out Tek-Tips Disney
Yeah, I was stuck in Disney's Tower of Terror once.

 

[lb63640]

Glen, we did do a reboot (included in the power cycling), but the mysterious DNS entries were not numbers we'd ever used before.

Winoto, we KNOW the tech HAD to be the one to do it---how else are you going to check IP blocks...with psychic powers?

 

[3wsparky]

this has been know with windows servers updating other windows servers , this wont help much but windows servers try to update other windows servers so you can infact endup with a posioned route from another server , i can't give you much more than that coz i cant remember how it happens but the moral of this is that it dont have to be because of a reboot or someone fiddling with the box.

sparky