Windows 2008 R2 DNS Server Doesn’t Use Root Hints

windowswindows-server-2008windows-server-2008-r2

We are seeing this on at least four of our Windows 2008 R2 DNS servers/DCs across two Windows domains.

If no forwarder is set hosts for non-authorized domains are not resolved. Perhaps related: there are "Conditional Forwarders" in place. To workaround this we have set the Windows 2003 DNS servers as forwarders, but its time to retire the Windows 2003 servers.

Current Settings…
Forwarders
-blank-
Use root hints if no forwarders are available. [checked]

Advanced
Disable recursion [unchecked]
BIND secondaries [unchecked]
Fail on load if bad zone data [unchecked]
Enable round robin [checked]
Enable netmask ordering [checked]
Secure cache against pollution [checked]

Root Hints
-Populated-
a.root-servers.net 198.41.0.4, etc…

What I've tried so far…

I've tried updating the root hints from the Windows 2003 DNS servers, I've also tried from Google's public DNS server (8.8.8.8) as well as 4.2.2.2 http://technet.microsoft.com/en-us/library/cc730735.aspx

I've tried all combinations of forwarders with "Use root hints if no forwarders are available" checked and unchecked. I also tried an invalid forwarder of (127.0.0.2). Also tried toggling the inSlave registry setting.
http://support.microsoft.com/kb/2001154

Then I tired to set the Max Cache TTL with its registry setting, DWORD MaxCacheTtl

I'm stumped and about to actually call Microsoft. 🙁

Best Answer

Got it...

From: http://weblogs.asp.net/owscott/archive/2009/09/15/windows-server-2008-r2-dns-issues.aspx

It appears that the Internet isn’t fully up to date and ready to use EDns quite yet. The solution for this is to disable EDns and wait another year or two until Akamai and other DNS servers catch up....
Note that this isn’t a problem for most Windows Server 2008 R2 member servers. It’s only a problem for DNS servers that do recursive lookups. i.e. likely only your domain controller will be affected if that is where your DNS Server role exists.

Fix

To disable EDns, you can do it from the command prompt, or by editing the registry.

From the command prompt, no restart of DNS is required. If from the registry, make sure to restart the DNS Server service.

Command prompt: 

dnscmd /config /EnableEDNSProbes 0

No restart is needed. It takes effect immediately.

or Registry:

Create a DWORD called EnableEDNSProbes and set to 0 in

HKLM\SYSTEM\CurrentControlSet\services\DNS\Parameters

Restart the DNS Server service for it to take effect.

Related Topic