DNS issue

PSX_Defector

@PSX_Defector said:

Depends on the vendor, maybe your DNS servers are not getting the info properly.

SBS is using 8.8.8.8 and 8.8.4.4 as the forwarders

Strange, maybe the NS is doing some kind of tricks on their end to put in the WWW for the customer. But I can only see what I see.

C:\Users\v436525\Downloads\BIND9.10.1-P1.x64>dig @8.8.8.8 guardiananytime.com an
y

; <<>> DiG 9.10.1-P1 <<>> @8.8.8.8 guardiananytime.com any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50753
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;guardiananytime.com. IN ANY

;; ANSWER SECTION:
guardiananytime.com. 21599 IN SOA dns1p.prod.gliconline.com. bnico
lai.glic.com. 2005165536 21600 3600 604800 600
guardiananytime.com. 21599 IN NS rdrcdns.glic.com.
guardiananytime.com. 21599 IN NS dns1p.prod.gliconline.com.
guardiananytime.com. 3599 IN A 63.66.47.183

;; Query time: 202 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Feb 23 11:24:07 Central Standard Time 2015
;; MSG SIZE rcvd: 172

C:\Users\v436525\Downloads\BIND9.10.1-P1.x64>dig @8.8.4.4 guardiananytime.com an
y

; <<>> DiG 9.10.1-P1 <<>> @8.8.4.4 guardiananytime.com any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51353
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;guardiananytime.com. IN ANY

;; ANSWER SECTION:
guardiananytime.com. 21578 IN SOA dns1p.prod.gliconline.com. bnico
lai.glic.com. 2005165536 21600 3600 604800 600
guardiananytime.com. 21578 IN NS rdrcdns.glic.com.
guardiananytime.com. 21578 IN NS dns1p.prod.gliconline.com.
guardiananytime.com. 3578 IN A 63.66.47.183

;; Query time: 37 msec
;; SERVER: 8.8.4.4#53(8.8.4.4)
;; WHEN: Mon Feb 23 11:24:28 Central Standard Time 2015
;; MSG SIZE rcvd: 172

tonyshowoff

@JaredBusch said:

Do people not read? I clearly stated that his was not a domain owned by the SBS server....

I know I don't.

Dashrender

I'm betting the DNS has a *.guardiananytime.com listing and that's what's being picked up. But for some reason, the client was failing over to IPv6 for the WWW request instead of getting forward to the * entry.
And if not a * DNS, PSX is probably right that the DNS provider is doing a * entry transparently.

doyle.jack

I generally skip forwarders all together. I've never used them. But then again, I've never found a reason to.

Dashrender

@doyle.jack said:

I generally skip forwarders all together. I've never used them. But then again, I've never found a reason to.

I take this to mean that you rely on the Root Hints alone?

doyle.jack

@Dashrender - You generally rely on one or the other. I don't know that it will use both root hints and forwarders.

You do get slightly better performance out of forwarders, but we're talking about miliseconds. Also, if you have multiple DNS servers, you should remember that forwarders are not stored in Active Directory. You would need to configure your forwarders on each of your DNS servers independently.

Root Hints tend to provide more redundancy. While you only see thirteen of them in the list, many of them are distributed geographically and provide their own type of fault tolerance. I believe there are 457 active root DNS servers right now.

The difference in performance is so small that it's really only a matter of preference. You'll get the same result with either. The only real difference is that when you are using Root Hints, you'll perform a series of iterative queries and expect referrals until you get the authoritative server for the domain you're interested in. When you use a forwarder, you're sending a single recursive query to the forwarder and letting that DNS server handle all of the iterative queries and return you the final answer.

Personal preference. I go with the one that requires less configuration and provides more reliability, even if it's at the expense of a few miliseconds on the response time.

Dashrender

Yeah, that's what I figured.

Nice write up!

doyle.jack

@Dashrender Thank you. I made two quick edits. I had originally used "query" in one place and meant to make it plural. Also, I put that Forwarders are not stored in DNS and meant to type Active Directory. I guess DNS was just on my mind.. hehe.

I do believe that Windows DNS Server has an option to use Root Hints if forwarders are not available, so if you ever do use Forwarders, you probably want to turn that feature on as a backup.

Dashrender

Your changes were appearing while I was reading it.

I normally have about 6-8 forwarders when I use them so I rarely have an issue. Though if I'm having that kind of issue I probably have bigger problems.

I've never had good luck with Root Hints, always odd issues would pop up. But if you use forwarders don't use your ISPs either..