question

ManishChawda-0385 avatar image
0 Votes"
ManishChawda-0385 asked ManishChawda-0385 commented

Primary / Secondary DNS Configured but only Primary able to resolve query

Hi,

I have attached the screenshot of my DNS Manager where in I have configured various domains. I have successfully configured zone transfer from primary to secondary.
Now the issue is that if I switch off Primary DNS and try to resolve domains from client based on Secondary DNS, it is not able to resolve.

Kindly advise what else configurations are required so that in case if Primary DNS is down then from client PC I can resolve the query.

OS used -- Windows Server 2016 STD / Windows 10 Prof.

Note - I have only configured DNS, no AD.

Primary DNS Server - 172.16.2.230 -
NIC - Screenshot attached


Secondary DNS Server - 172.16.2.231
NIC - Screenshot attached

Windows Client - 172.16.2.188
NIC - Screenshot attached

140511-secondary-dns-server.jpg140503-secondary-dns-server-nic.jpg140427-primary-dns-server.jpg140472-primary-dns-server-nic.jpg


windows-dhcp-dns
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

GaryReynolds avatar image
1 Vote"
GaryReynolds answered ManishChawda-0385 commented

Hi @ManishChawda-0385

Its hard to confirm what's causing the issue, but here are few things to check.

When you configured the secondary and allowed the zone transfers, you used the zone transfers tab to add the server, rather than the Name Servers. This means that the secondary server doesn't have an NS record added to the zone. This might cause a problem if NS1 is offline and the client tries to query the SOA record and tries to make queries against the authoritative NS for the zone.

One thing that doesn't look right is that you have ns1.devdns.org as 172.16.2.152, but the IP address of the server is 172.16.2.231, do you have another DNS server in the mix?

The best thing to do is check that the DNS servers are working correctly, if you use NsLookup to run queries against each server to confirm that both servers are returning the expected records.

Gary.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi,

My goal is to create different domains, give them separate IPs with sub-domain. Also host them on IIS which I have already done. Practice different DNS Records etc....

Yes, I have used Zone transfer tab to add the server. and then on secondary server I clicked -- Transfer from Master

I have attached word file for your reference. Please advise. 140575-windows-server-2016-std.pdf


0 Votes 0 ·
GaryReynolds avatar image
1 Vote"
GaryReynolds answered ManishChawda-0385 commented

Hi @ManishChawda-0385

From the screenshots things look ok, but you will need to complete a few more tests to fully test DNS configuration.

The error that is being reported in nslookup is because you don't have an reverse ptr record for the 172.16.2.230 & 172.16.2.231 ip addresses. If you create those records that will fix those errors.

Here is the list of commands that you need to run in the nslookup console to confirm the DNS configuration, run these from both servers and the workstation:

 server 172.16.2.230
 set type=soa
 devdns.org
 set type=ns
 devdns.org
 set type=a
 ns1.devdns.org
 www.devdns.org

 server 172.16.2.231
 set type=soa
 devdns.org
 set type=ns
 devdns.org
 set type=a
 ns1.devdns.org
 www.devdns.org

Complete these commands and record the results with both DNS servers switched on, then switch off NS1 and repeat a sub set of the commands from server 172.16.2.231 down on NS2. Complete the following commands from the workstation:

 set type=soa
 devdns.org
 set type=ns
 devdns.org
 set type=a
 ns1.devdns.org
 www.devdns.org

Then share the results once you have completed the testing.

Gary.


· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @ManishChawda-0385

Just checking in to see if there is any update on this one?

Gary.

0 Votes 0 ·

Hi,

I am attaching the results.doc file. Kindly let me know if I have done as you intended or not and guide for next action to resolve my query.142487-results.pdf


0 Votes 0 ·
results.pdf (304.8 KiB)

Hi @ManishChawda-0385

The DNS servers configuration looks good.

If you could do one more test, with NS1 switched off, can you try and ping www.devdns.org and devdns.org and see if you can access the webpage or services that were failing previously.

If that fails please capture the results from ipconfig /displaydns

Gary.

0 Votes 0 ·

Hi,

C:\Users\Administrator>ipconfig /displaydns

Instead of devdns.org for some reason I had created new i.e. indiadns.com and the IP of NS2 - 172.16.15.185
The result is below

Windows IP Configuration

 indiadns.com
 ----------------------------------------
 Record Name . . . . . : indiadns.com
 Record Type . . . . . : 1
 Time To Live  . . . . : 3591
 Data Length . . . . . : 4
 Section . . . . . . . : Answer
 A (Host) Record . . . : 172.16.15.185
0 Votes 0 ·
LimitlessTechnology-2700 avatar image
1 Vote"
LimitlessTechnology-2700 answered GaryReynolds commented

Hello ManishChawda,

It will, if the machine is rebooted. There is a time out and believe it or not, it's like 2 hours before a computer will default to the secondary. Fastest way is to reboot the machine.

It will use the second address, but only after a timeout period the client is waiting for a response from the server. If the first entry responds but doesn't have an answer, which is what we call an NXDOMAIN response (when the DNS server doesn't have an answer but it STILL responded), it won't go to the second entry, because it got an answer, even though it is not the answer we wanted.

Also flushing the DNS resolver cache and restarting DNS client services on users PC maybe an alternative

ipconfig /flushdns

Below is Microsoft url for DNS clients time out settings.

https://docs.microsoft.com/en-US/troubleshoot/windows-server/networking/dns-client-resolution-timeouts



--If the reply is helpful, please Upvote and Accept as answer--

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.


When using the nslookup command to query the DNS server, the DNS cache is not used and requests are sent directly to the specified DNS server and the responses from the DNS server is displayed.

Test mentioned above was to understand if the secondary DNS server was configured correctly and if it would work when NS1 was switched off, there wouldn't be a NXDOMAIN in this scenario.

Gary.

0 Votes 0 ·