Trouble resolving one site only (symantec)

  • Thread starter Thread starter Mick
  • Start date Start date
M

Mick

I've been looking at this for most of the afternoon and I'm hoping someone
can save my sanity.

I found I couldn't get onto www.symantec.com.au using Internet Explorer. I
did an nslookup from my PC and it timed out. I tried if from the 2003
AD/DNS server, timeout also. Checked my forwarders and changed the nslookup
to each one of my forwarders in turn and nslookup was fine. Changed
nslookup back to 2003 server and still timeout for www.symantec.com.au .
Tried any other site and no problem. We have about 600 users on this
network and no one else is complaining.

I turned on DNS logging. I can see the queries go out the first forwarder
and then the second forwarder, but no reply.

I next setup our CISCO 6509 to do port monitoring of the server port and
used Ethereal to capture DNS packets. Same thing as the log, I can see DNS
queries being sent to the forwarders, but no replies. All other domains
appear to work, and when I change nslookup to go directly to the forwarder I
see the query and get an immediate reply.

On Ethereal the two queries seem very similiar, the only difference I have
noted is the query going via 2003 has an additional RR with some info such
as Name: <Root> Type: EDNS0 option, ...

I'm the first to admit I'm no DNS guru, and am hoping someone can explain to
me why I can resolve this address when talking directly to the forwarders,
but not via my 2003 DNS server.

Hoping someone can give me some clues. Thanks in advance.
 
In
Mick said:
I've been looking at this for most of the afternoon and I'm hoping
someone can save my sanity.

I found I couldn't get onto www.symantec.com.au using Internet
Explorer. I did an nslookup from my PC and it timed out. I tried if
from the 2003 AD/DNS server, timeout also. Checked my forwarders and
changed the nslookup to each one of my forwarders in turn and
nslookup was fine. Changed nslookup back to 2003 server and still
timeout for www.symantec.com.au . Tried any other site and no
problem. We have about 600 users on this network and no one else is
complaining.

I turned on DNS logging. I can see the queries go out the first
forwarder and then the second forwarder, but no reply.

I next setup our CISCO 6509 to do port monitoring of the server port
and used Ethereal to capture DNS packets. Same thing as the log, I
can see DNS queries being sent to the forwarders, but no replies.
All other domains appear to work, and when I change nslookup to go
directly to the forwarder I see the query and get an immediate reply.

On Ethereal the two queries seem very similiar, the only difference I
have noted is the query going via 2003 has an additional RR with some
info such as Name: <Root> Type: EDNS0 option, ...

I'm the first to admit I'm no DNS guru, and am hoping someone can
explain to me why I can resolve this address when talking directly to
the forwarders, but not via my 2003 DNS server.

Hoping someone can give me some clues. Thanks in advance.
Click to expand...

You can either disable EDNS0 or update your router to support it.
Here's how to disable it:

828731 - An External DNS Query May Cause an Error Message in Windows Server
2003:
http://support.microsoft.com/?id=828731

--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.
 
Thanks so much Ace and Jonathan, you guys are tops ...

I found my PIX had "fixup protocol dns maximum-length 512" so I changed it
to 4096 and now
everyone is happy.

At least you learn something you didn't know before when things go wrong ;-)
 
In
Mick said:
Thanks so much Ace and Jonathan, you guys are tops ...

I found my PIX had "fixup protocol dns maximum-length 512" so I
changed it to 4096 and now
everyone is happy.

At least you learn something you didn't know before when things go
wrong ;-)
Click to expand...

We're always glad when we are able to successfully help someone, and yes,
this business is a non-stop learning environment!

Cheers!

Ace
 
Back
Top