Event ID 5504

[itadmin]

Hello,

We have just recently started seeing the following
repeated log entries on AD DNS servers (ie not public).
They are also DC's. Is this a possible security threat
(some type of DNS spoofing) and what can I do to resolve
this issue.

The DNS server encountered an invalid domain name in a
packet from 192.168.1.xxx. The packet is rejected.

thanks in advance

 

[Kevin D. Goodknecht Sr. [MVP]]

In itadmin <[email protected]>
posted their concerrns,
Then Kevin D4Dad added his reply at the bottom.

Hello,

We have just recently started seeing the following
repeated log entries on AD DNS servers (ie not public).
They are also DC's. Is this a possible security threat
(some type of DNS spoofing) and what can I do to resolve
this issue.

The DNS server encountered an invalid domain name in a
packet from 192.168.1.xxx. The packet is rejected.

thanks in advance

It sounds to me like you have some machines with illegal characters in their
names. If it is a client rename them, if it is a DC your in trouble.