If both forwarders have answer, why does DNS server still timeout on request

domain-name-systemwindows-server-2012-r2

In what circumstances would a DNS server request timeout when the forwarders already have the answer? For example, there appears to be a domain that I assume is having DNS issues at the moment us.army.mil. If I hit the forwarders directly with nslookup for type=mx then I get a response right away. If I hit our DNS server though with the same request it takes more than 2 seconds and times out or when I extend timeout to 10 seconds it fails. If I try multiple times it eventually returns a response.

It is my understanding that our DNS server should be sending requests for external domains to the forwarders and getting response if available. The log shows the first forwarder being hit and then after 3 seconds the second forwarder is attempted. How does my direct request to the forwarder not have problems while our server's does?

Best Answer

When you cascade DNS recursing servers and introduce forwarders, that is the kind of problem you meet.

One of your DNS servers is not answering correctly. All but authoritative servers can have a cache.

Two possibilities:

  • One of the authoritative server is not answering, but one of your cache has the good answer.
  • One of your forwarder/recursive server has a wrong entry in cache (can be a NS record, a CNAME, a delegation, ...).

dig command can help you know exactly which server is behaving incorrectly (but its output should be read carefully):

dig myhost @myfirstforwarder
dig myhost @myrealrecursor
dig -t NS myhost
dig -t any @authserver1
dig -t any @authserver2

and so on.

The trick is: don't put forwarders in place: only recursive servers and authoritative ones. Keep It Simple Stupid.

Related Topic