Incorrect response resolving illegal domain name???

  • Thread starter Thread starter Ken Morley
  • Start date Start date
K

Ken Morley

We have DNS running on a Windows 2000 Server patched to
the latest rev. When we attempt to resolve an illegal or
incomplete domain name such as "domain" (missing
the .com, .net, etc.), the Windows DNS service returns a
DNSFAIL response. We are being told that to be in
conformance with RFC, it should return NXDOMAIN (as if the
domain simply could not be found). Is that correct?

For complete backgound on the issue:
Our data center consists of about a dozen Windows 2000
servers and one Red Hat Linux 7.3 server running Sendmail
as a mail relay for our branches.

We have the DNS service running on one of the Windows
servers and it's providing DNS resolution for everything,
including the Linux server.

In situations where the users at the branches send email
to an illegal domain (missing the .com, .net, etc.), the
DNSFAIL response from Windows 2000 Server is essentially
putting SendMail in an infinite loop.

SendMail tries resending the message every 1 second, which
rapidly fills up the logs, etc. until the server runs out
of disk space.

When we point the Linux server to use an external DNS
server, the problem does not occur and the email simply
gets bounced as undeliverable.

Obviously, it is beyond the scope of this forum to support
Linux or SendMail, and I'm not requesting such. I just
want to know if the DNS service for Windows 2000 is in
conformance with the applicable RFC (please provide the
RFC number, if you have it) or if this is a known problem
with a resolution.

Thanks very much!

Ken Morley
 
KM> When we attempt to resolve an illegal or incomplete
KM> domain name such as "domain" (missing the .com, .net,
KM> etc.), the Windows DNS service returns a DNSFAIL response.

This is not a violation of an RFC constraint. It is, however, undesirable.
You need to find out what is causing this and fix it. Start by reading the
DNS Server logs. Then go to the machine running the DNS Server and perform
the process of query resolution by hand, starting from the "." content DNS
servers and using a tool such as "dig" or "dnsquery" to send each individual
query and display the response. If, moreover, your DNS Server is configured
to be a forwarder, use the same tools on the same machine to send the
appropriate queries to the forwardees to see how they respond.
 
Back
Top