DNS Help

[Guest]

I have a single Windows 2000 AD domain: corp.mydomain.com. I have two
Windows 2000 DNS servers: DNS1 is standard primary and DNS2 is standard
secondary to DNS1. Both are configured with forwarders to our ISP's two DNS
servers. Neither DNS server is accessible from the Internet, we have
split-brain DNS.
DNS2 is also running Exchange 2000 SP3. It is configured to query itself
for host name resolution (I do not have DNS servers configured on the SMTP
server). DNS1 is also configured to query itself for hostname resolution.
The problem I am troubleshooting is Internet message delivery. Once in a
while, I have a user forward me an NDR with the following error: "The
destination server for this recipient could not be found in Domain Name
Service (DNS). Please verify the email address and retry. If that fails,
contact your administrator." I will try to use nslookup to locate the MX
record like this:
C:\>nslookup -q=mx somedomain.com
Server: dns2.corp.mydomain.com
Address: 172.16.0.3

DNS request timed out.
timeout was 2 seconds.
*** Request to dns2.corp.mydomain.com timed-out
If I try the same steps from DNS1, I return the correct results. I have
eliminated our firewall as a potential problem; I can see DNS queries passing
from both DNS servers (most of the time). When the lookup fails, I do not
see traffic coming from DNS2 in our firewall logs (it is as though DNS2 is
not "asking"). A few hours later, it will start working correctly.
I have seen some references to a -d2 switch for nslookup but the output is
"robust". At the end of the output, it gives me the same error: "timed-out".

Any advice on how to troubleshoot this is much appreciated.
McR

 

[Phillip Windell]

I have a single Windows 2000 AD domain: corp.mydomain.com. I have two
Windows 2000 DNS servers: DNS1 is standard primary and DNS2 is standard
secondary to DNS1. Both are configured with forwarders to our ISP's two DNS
servers. Neither DNS server is accessible from the Internet, we have
split-brain DNS.

That doesn't describe "Split DNS". It describes just simply having two
redundant DNS Servers on a LAN, which is extremely common,..but is not
Split-DNS. The two DNSs would use themselves and each other in their
"TCP/IP Settings". Then they would both, as you indicated, use the ISPs DNS
as a Forwarder. Every machine on your LAN must use those two DNS Servers in
the TCP/IP Config and not have any other DNS in there. Both of your DNS
Server, or course, must be allowed by your Firewall to make DNS Queries to
your ISP's DNS.

Split-DNS is used when you use the same name for your AD Domain Name as what
your "Internet Presents" uses for a public FQDN. To me that is always a bad
deal, but many still do it anyway. In Split-DNS one DNS sits on the inside
of the LAN and resolves the proper portion of your namespace to your
internal LAN's Private addresses,...the other DNS sits on the outside and
resolves your public side of the namespace to the correct public IP#s. This
is where the Split-DNS gets it's name "Split". If that was what you truely
desired to implement,...then this article is a good source of how to perform
it:

[Those are underscores, not spaces between the words]
You Need to Create a Split DNS!
http://www.isaserver.org/tutorials/You_Need_to_Create_a_Split_DNS.html

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/techinfo/Guidance/2004.asp
http://www.microsoft.com/isaserver/techinfo/Guidance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
-----------------------------------------------------