Windows DNS Client Not Querying Specified DNS Server Without Connection Specific Suffix

Question

We have 3 DCs, all running the DNS role. These servers hold the records for the domain itself but also "external" records using split-horizon DNS. IP Addresses for the servers are all static whereas the clients all have DHCP-assigned addresses.

Currently, we are testing a new subdomain we'll call this timesheets.domain.co.uk, internal IP is 10.2.2.21, and this is hosted on DC04.domain.local. We also have remote.domain.co.uk which is also using split DNS, external DNS is in Cloudflare, internal record points to 10.2.2.102.

(If relevant, the DHCP server assigned domain.local as a DNS suffix. But we've tried changing that with no difference)

Running

NSLOOKUP timesheets.domain.co.uk
NXDOMAIN

Whereas

NSLOOKUP remote.domain.co.uk
A: <external IP>

returns external IP.

If we check wireshark for DNS queries against that server, we can see that every DNS query coming from Windows clients has the domain appended. For instance, testing.domain.co.uk.domain.local.

i.e.

NSLOOKUP timesheets.domain.co.uk.domain.local

Whereas the Windows servers all attempt to resolve the suffix first before removing the suffix.

i.e.

NSLOOKUP timesheets.domain.co.uk.domain.local
NXDOMAIN
NSLOOKUP timesheets.domain.co.uk
A: 10.2.2.21 

Any ideas, suggestions or tips on where to look for a difference between the servers and clients as to why they would be doing this?

Answer 1

Hello,

Thank you for posting in Q&A forum.

You can check the DNS Fuffix configuraiton by below method:

1. On windows client, open adaptor property and go to advanced TCP/IP setting, you will be able to configure the Domain Search List Order and Connection-specific DNS suffix.

There's high possibility that it's caused by the configuration here.

2. On DHCP Server configuration, you can also check "Option" if there's any preference setting related to DNS suffix.
3. You can double check if there's any configuration dispatched from Group Policy Settings.

Hope the answer can help you better troubleshoot this issue.