DNS Servers – Why Have a Secondary DNS Server?

If you want to delegate authority for a section of your domain you are going to need to add another level to the hierarchy.

When a recursive DNS server asks for the address for ftp.econemon.com it is going to go through a number of steps. First it is going to ask one of the root servers which will reply with the name servers for the .com domain (this step will likely be cached and only done infrequently). It will then ask the .com servers and they will respond with the name servers for the econemon.com domain. Finally it will ask these servers for the address record for ftp.econemon.com.

In theory you could simply add ftp.econemon.com as an NS entry in the parent zone

e.g:

services     NS    ns1.econemon.com.
ns1          A     192.0.2.1

And then create ftp.econemon.com as a zone in your name server. But if you do it this way you will have to create a new zone per server. What you probably want to do is ask your provider to add a delegated subdomain.

e.g.:

services     NS    ns1.services.econemon.com.
services     NS    ns2.services.econemon.com.
ns1.services A     192.0.2.1
ns2.services A     192.0.2.2

You can then add services.econemon.com as a zone on your name servers and simply add new entries as you need them in this single zone.

If you really need the short names too it shouldn't be too much trouble to get CNAME records added such that ftp.econemon.com has a canonical name of ftp.services.econemon.com which leaves you able to change the IP address whenever you want to and allows users to use a short name.

ftp.econemon.com.    CNAME    ftp.services.econemon.com.

Windows queries DNS in this order:

• hosts file
• local DNS cache
• Preferred DNS servers
• Other DNS servers

MS also has an article describing how the DNS server list is obtained:

The DNS Client service uses a server search list, ordered by preference. This list includes all preferred and alternate DNS servers configured for each of the active network connections on the system.

The list is arranged based on the following criteria:

• Preferred DNS servers are given first priority.
• If no preferred DNS servers are available, then alternate DNS servers are used.
• Unresponsive servers are removed temporarily from these lists.

Windows has an escalating timeout for DNS requests:

Value      Default value  Attempt
1st limit       1 second  Query the preferred DNS server on a preferred connection.
2nd limit      2 seconds  Query the preferred DNS server on all connections.
3rd limit      2 seconds  Query all DNS servers on all connections (1st attempt).
4th limit      4 seconds  Query all DNS servers on all connections (2nd attempt).
5th limit      8 seconds  Query all DNS servers on all connections (3rd attempt).
6th value                 (Must be 0.)

I could not find a clear answer on this exact point, but it sounds like if it doesn't get a response from your primary DNS in 1 or 2 seconds (1st or 2nd attempt, respectively), then that server will be removed from the DNS server lookup list for 15 minutes, and so it will use the secondary DNS servers. Since those servers have up to an 8 second timeout, they are much more likely to respond. (It's unclear to me if it continues to query the preferred DNS server during the 3rd+ attempt if it's already failed).

I also suspect that you do indeed have a WAN latency issue for this geographical area, as it would explain why the timeouts are working.

One solution is to change the DNS query timeouts, using the DNSQueryTimeouts registry parameter. See also http://drewthaler.blogspot.com/2005/09/changing-dns-query-timeout-in-windows.html

Another solution is to put a local caching DNS server on the network, and have the clients use that. You can use a DNS server that may be built in to a router, or install something like dnsmasq.