Home / server / Questions / 383802
Accepted
kleefaj
Asked: 2012-04-28 04:28:36 +0800 CST

I think the DNS configuration I inherited is misconfigured. Would like help to verify

  • 772

I hope this isn't too headache-inducing.

Two servers, server1 (Windows Server 2003, IP 192.168.100.25) and server2 (Windows Server 2008, IP 192.168.100.22).

server2 is the DHCP server and a DNS server. server1 is the preferred DNS server as is set in the DHCP server options (192.168.100.25 is preferred, 192.168.100.22 is alternate); servers use static IPs.

server1 is forwarding DNS requests to server2. (I'm not sure why but it is, what that buys us.)

server1's preferred DNS server is itself (.100.25); server2's preferred DNS server is server1, and itself is the alternate.

The way I read this, clients make a DNS request to server1 which forwards the lookup to server2, server2 responds with an answer to server1 and server1 returns the answer to the client.

Following the above logic, if server2 makes a DNS request it asks server1 (!) which forwards the request to server2 (!!) which sends the answer back to server1 (!!!) which sends it back to server2 (!!!!).

In my test lab I have each DNS server (I have two) using it's own IP address as the Preferred DNS server. I'm inclined to remove the Alternate DNS server address from each (server1, server2) server's settings, and make Preferred DNS sever it's own address (server2's preferred DNS server will be .100.22, server1's will be .100.25).

Here's me running nslookup on server2:

C:\Users\administrator.yournamehere>nslookup
Default Server:  UnKnown
Address:  ::1

> www.google.com
Server:  UnKnown
Address:  ::1

Name:    www.l.google.com
Addresses:  74.125.226.20
          74.125.226.19
          74.125.226.16
          74.125.226.18
          74.125.226.17
Aliases:  www.google.com
windows-server-2008 windows-server-2003 domain-name-system internal-dns

2 Answers

  1. Best Answer

    I assume that Server1 and Server 2 are Domain Controllers?

    If so:

    • Server1 and Server2 should point to themselves for DNS

    • Internal client machines should point to Server1 and Server2 for DNS

    • Server1 and Server2 should be set to forward requests that they cannot resolve to an external DNS service. Server1 should not be forwarding queries to Server2 or vice versa.

    • 3

  2. It's unorthodox, but not wrong... or broken. It's a generally accepted practice that each DNS server point to itself for primary DNS, but that isn't a requirement. The DNS client settings on Server1 and Server2 are for the DNS client component on the servers, not for the DNS Server component. The DNS client and DNS server components are independent of each other. When a DNS client sends a query to the DNS server component on Server1 it gets forwarded to the DNS server component on Server2, which then uses it's configured forwarders or Root Hints to resolve the query.

    The fact that the DNS client component on Server2 is using Server1 as it's primary DNS affects DNS queries from the DNS client component on Server2, it has no bearing on the operation of the DNS server component on Server2. So you'd have something like this:

    Server2 DNS client component asks Server1 DNS server component for google.com---> Server1 DNS server component forwards the request to the DNS server component on Server2---> the DNS server component on Server2 uses it's configured forwarders or the Root Hints to resolve the query for the DNS server component on Server1, which returns the answer to the DNS client component on Server2.

    • 1