DNS resolve issues

Question

Hi,

We do have an hybrid environment where several servers / clients computers are either on-prem or in Azure. To be able to reach on-prem resources, we have deployed 2 DNS forwarders in Azure (2 VM's with the DNS Services installed and only conditional forwarders)

Those 2 DNS forwarders are configured on all Azure VNet as 1st and 2nd DNS. We also have added Azure DNS (168.63.129.16) as the 3rd DNS Servers. So all VM's in Azure have 3 DNS Servers

1. DNS Forwarder-1
2. DNS Forwarder-2
3. 168.63.129.16

Most of the time, it work well but it happen few times that a client could not connect to a "domain joined" resource either in azure on on-prem.

So i decided to capture network traces using Network Monitor and i found that the client computer is making query to DNS Forwarder-1 as expected but for an unknown reason, it stop using the DNS Forwarder-1 and then jump to DNS Forwarder-2 and then to Azure DNS (168.63. 129.16). Because Azure DNS cannot resolve on-prem resources, the DNS query fail. When this situation is happening, there is nothing to do except wait around 10 minutes to be able to contact DNS Forwarder-1 or DNS Forwarder-2...

Anybody had this issue before... and is there anything to do to prevent this ?

Thanks!

Answer 1

Hi @Anonymous

I haven't seen this issue before, and most things I could suggest might seem like teaching you to suck eggs.

One thing I would look for is any ICMP packets in the trace to see if there are route or next hop issues and client has determined the forwarders are no longer reachable.

Gary.

Answer 2

Hello there,

This behavior exists when one or more DNS server IPs are configured as forwarders or conditional forwarders on a DNS server.

You can check this article which explains what is the default behavior of a DNS server when more than two DNS servers are configured as forwarders https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/forwarders-resolution-timeouts

Please check these discussions for a better understanding of this.

How to get on-prem DNS to resolve the FQDN of Azure Resource to its IP https://learn.microsoft.com/en-us/answers/questions/766816/how-to-get-on-prem-dns-to-have-azure-vm-azure-reso.html

Azure Private DNS Zone Resolution from On-prem https://learn.microsoft.com/en-us/answers/questions/181776/azure-private-dns-zone-resolution-from-on-prem.html

--------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–

Answer 3

Update...

We found that by removing the suffix DNS on our DNS forwarders has fixed issues with most VM's but some issues still happening mostly with Windows 2008 / 2008R2 VM's

We have opened a ticket with Microsoft to try to find out the root cause but without success. But we found a workaround by applying only our 2 customs DNS forwarders (DNS Forwarder-1 and DNS Forwarder-2) on the NIC of the Windows 2008 / 2008 R2 VM.

With this configuration, the VM gets only the 2 custom DNS and no more issues.

But we still have this issue with all OS versions... so we will probably remove the Azure DNS IP from the VNet configuration.

Thanks!