0

Strange DNS problem for which I hope you can help.

Active Directory with NETBIOS name "Shortdomain" and as FQDN "verylongdomainname.lan". Domain controller DC01 behind firewall. IP: x.x.x.1

Customer site, connected over VPN. Customer has local DNS Server. On their DNS Server I wanted to create a new conditional forwarder zone. In DNS manager I enter "verylongdomainname.lan" and when I enter IP x.x.x.1 I first get a timeout but after the timeout it shows the NETBIOS name "Shortdomain" where I would have expected the FQDN name for the server. I then click OK and the zone is added.

On any server in customer site, I fail to resolve any server in "verylongdomainname.lan", but when I start nslookup and then run the command "Server x.x.x.1", I successfully connect to the DNS server and I am then able to resolve all server names in the "verylongdomainname.lan" domain. To me this proves routing and firewalling is permitting a connection from customer to DNS Server x.x.x.1. Correct ???

Any idea why the conditional forwarding is not working and how to fix it?

From the command line:

    command: nslookup
    result: y.y.y.5 

    command: server1.verylongdomainname.lan 
    result: domain not found 

    command: server x.x.x.1 
    result: server (x.x.x.1) 

    command: server1.verylongdomainname.lan
    result: server1.verylongdomainname.lan x.x.x.7 (which is correctly resolved)
Gabrie
  • 123
  • 6
  • Can you include more specifics in your question? Maybe include the output of the nslookup commands you are issuing? – Zoredache Sep 17 '14 at 18:32
  • Update your question then. – Zoredache Sep 17 '14 at 18:55
  • I deleted my extra comments and updated my question with commandline results. – Gabrie Sep 17 '14 at 19:07
  • Can the y DNS servers actually reach the x DNS servers? Have you verified that? It would appear that they can seeing as they resolved the names of the forwarders, but I would run some tests from y DNS to x DNS. Also, run nslookup on y DNS server in debug mode when you run your tests so that you can see more detail of the interaction. – joeqwerty Sep 17 '14 at 19:27
  • Can you do a debug output of an nslookup instead? (nslookup, then "set option d2" then do your lookups). (oops...like joe said) – TheCleaner Sep 17 '14 at 19:49

1 Answers1

0

Turned out that the customer DNS Servers itself weren't able to access my DNS Servers. Some NAT rule on customer side wasn't correct. Thanks for the tips!

Gabrie
  • 123
  • 6