question

KeithCrofutt-8441 avatar image
0 Votes"
KeithCrofutt-8441 asked DSPatrick answered

DNS not resolving for one specific external domain from our domain controllers. All others work.

There is one external domain that used to work, but recently is no longer resolving from our internal network. We use the built-in DNS service from Microsoft Server. Changing the DNS setting on internal systems to an open DNS, such as 1.1.1.1 solves the issue, but this is not ideal as a resolution for our internal systems.

Any ideas what can be checked, why this could be impacting just the Microsoft DNS services? There are no other external domains that seem to be having the issue. Doing packet tracing, they always stop after getting to the internal DNS.

windows-dhcp-dns
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DSPatrick avatar image
0 Votes"
DSPatrick answered

Website or windows domain traffic? For the latter you'll need a VPN between sites.

--please don't forget to upvote and Accept as answer if the reply is helpful--



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KeithCrofutt-8441 avatar image
0 Votes"
KeithCrofutt-8441 answered

It is just browser traffic. The external domain is a public webpage by a third-party, no VPN needed to reach it. It is just traffic on our internal domain, using our Windows Server DNS that has issue to just this one external website.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DSPatrick avatar image
0 Votes"
DSPatrick answered DSPatrick commented

external domain is a public webpage by a third-party

There's not much you can do other than try using different forwarders. May need to ask the site owner about the issue.

--please don't forget to upvote and Accept as answer if the reply is helpful--







· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--



0 Votes 0 ·
KeithCrofutt-8441 avatar image
0 Votes"
KeithCrofutt-8441 answered

Nope, we thought for a bit it might have been Defender or Intune but there are no settings to block/filter websites. When running the built in Windows Diagnostics after failure to reach the site, it reports that DNS server are unavailable. This is obviously not true since every other website and resource works with no issues, internal and external. So at this point we are baffles. Traces show the browsers reaching the DNS servers, but then nothing. Packets die.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DSPatrick avatar image
0 Votes"
DSPatrick answered DSPatrick commented

it reports that DNS server are unavailable

What DNS server? There are many public DNS servers. The site itself may have some sort of registration problem, may need to contact the site owner.

--please don't forget to upvote and Accept as answer if the reply is helpful--







· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--



0 Votes 0 ·
GaryReynolds avatar image
0 Votes"
GaryReynolds answered GaryReynolds edited

Hi @KeithCrofutt-8441

You could try enabling debug logging on the DNS server, to see why the query is failing and if it's a specific forwarder that is causing the problem.

To enable the logging open the server properties in the DNS console and set the debug logging tab as shown, setting the file path to something that's appropriate for your server:
140973-dns-debug.png

Then use nslookup to query the site a couple of times and access the webpage.

You will need to disable the debug logging for the log to be flushed to the drive.

Review the log file and see if you get any insights why the query for domain is failing.

Gary.



dns-debug.png (18.7 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi,

One other thing to check, make sure that a conditional forwarder has been setup for the domain, as this could cause issues for a specific domain, while others work as expected.

Gary.

0 Votes 0 ·
KeithCrofutt-8441 avatar image
0 Votes"
KeithCrofutt-8441 answered

When trying to set up a forwarder, it eventually times out stating that the remote domain could not be verified. For now we are trying to arrange a meeting with the IT support for the remote domain. They just switched to a cloud provider so it seems to be related to that change and not us.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DSPatrick avatar image
0 Votes"
DSPatrick answered

Makes sense, glad to hear of progress.

--please don't forget to upvote and Accept as answer if the reply is helpful--



5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.