DNS issue
-
WOW, now I'm the ass - seriously I need new glasses - Sorry @JaredBusch
-
@Dashrender said:
WOW, now I'm the ass - seriously I need new glasses - Sorry @JaredBusch
Coffee helps at this time of the day.
Note: I realize that this is a global forum and I will note that Coffee helps me at any time of the day.
-
There's no CNAME or A record for WWW. Fresh from dig.
C:\Users\v436525\Downloads\BIND9.10.1-P1.x64>dig guardiananytime.com any
; <<>> DiG 9.10.1-P1 <<>> guardiananytime.com any
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8836
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 3;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;guardiananytime.com. IN ANY;; ANSWER SECTION:
guardiananytime.com. 3553 IN A 63.66.47.183
guardiananytime.com. 86353 IN NS dns1p.prod.gliconline.com.
guardiananytime.com. 86353 IN NS rdrcdns.glic.com.
guardiananytime.com. 86353 IN SOA dns1p.prod.gliconline.com. bnico
lai.glic.com. 2005165536 21600 3600 604800 600;; ADDITIONAL SECTION:
dns1p.prod.gliconline.com. 86353 IN A 63.66.47.140
rdrcdns.glic.com. 86353 IN A 208.253.53.149;; Query time: 260 msec
;; SERVER: 10.1.3.12#53(10.1.3.12)
;; WHEN: Mon Feb 23 11:00:18 Central Standard Time 2015
;; MSG SIZE rcvd: 204Need to either put one in or have whomever hosts it put one in.
-
@doyle.jack Welcome to MangoLassi!
-
@PSX_Defector thanks, that at least means I am not crazy.
So this begs the question of why this works fine on every other network I have tried it on, just the one network where it fails.
But, I do not care at this point as the user can now get there and sign in and do what she needs to do.
Maybe next week I'll have time to care about a 3rd party issue.
-
@JaredBusch said:
@PSX_Defector thanks, that at least means I am not crazy.
So this begs the question of why this works fine on every other network I have tried it on, just the one network where it fails.
Depends on the vendor, maybe your DNS servers are not getting the info properly.
Just slap in a CNAME record on the SBS for www to point to the root domain. It should resolve properly internally then.
-
@PSX_Defector said:
Depends on the vendor, maybe your DNS servers are not getting the info properly.
SBS is using 8.8.8.8 and 8.8.4.4 as the forwarders
@PSX_Defector said:
Just slap in a CNAME record on the SBS for www to point to the root domain. It should resolve properly internally then.
Pulling the IPv6 caused something to make it resolve or that is what I was going to do.
-
@JaredBusch said:
@PSX_Defector said:
Depends on the vendor, maybe your DNS servers are not getting the info properly.
SBS is using 8.8.8.8 and 8.8.4.4 as the forwarders
Strange, maybe the NS is doing some kind of tricks on their end to put in the WWW for the customer. But I can only see what I see.
C:\Users\v436525\Downloads\BIND9.10.1-P1.x64>dig @8.8.8.8 guardiananytime.com an
y; <<>> DiG 9.10.1-P1 <<>> @8.8.8.8 guardiananytime.com any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50753
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;guardiananytime.com. IN ANY;; ANSWER SECTION:
guardiananytime.com. 21599 IN SOA dns1p.prod.gliconline.com. bnico
lai.glic.com. 2005165536 21600 3600 604800 600
guardiananytime.com. 21599 IN NS rdrcdns.glic.com.
guardiananytime.com. 21599 IN NS dns1p.prod.gliconline.com.
guardiananytime.com. 3599 IN A 63.66.47.183;; Query time: 202 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Feb 23 11:24:07 Central Standard Time 2015
;; MSG SIZE rcvd: 172C:\Users\v436525\Downloads\BIND9.10.1-P1.x64>dig @8.8.4.4 guardiananytime.com an
y; <<>> DiG 9.10.1-P1 <<>> @8.8.4.4 guardiananytime.com any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51353
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;guardiananytime.com. IN ANY;; ANSWER SECTION:
guardiananytime.com. 21578 IN SOA dns1p.prod.gliconline.com. bnico
lai.glic.com. 2005165536 21600 3600 604800 600
guardiananytime.com. 21578 IN NS rdrcdns.glic.com.
guardiananytime.com. 21578 IN NS dns1p.prod.gliconline.com.
guardiananytime.com. 3578 IN A 63.66.47.183;; Query time: 37 msec
;; SERVER: 8.8.4.4#53(8.8.4.4)
;; WHEN: Mon Feb 23 11:24:28 Central Standard Time 2015
;; MSG SIZE rcvd: 172 -
@JaredBusch said:
Do people not read? I clearly stated that his was not a domain owned by the SBS server....
I know I don't.
-
I'm betting the DNS has a *.guardiananytime.com listing and that's what's being picked up. But for some reason, the client was failing over to IPv6 for the WWW request instead of getting forward to the * entry.
And if not a * DNS, PSX is probably right that the DNS provider is doing a * entry transparently. -
I generally skip forwarders all together. I've never used them. But then again, I've never found a reason to.
-
@doyle.jack said:
I generally skip forwarders all together. I've never used them. But then again, I've never found a reason to.
I take this to mean that you rely on the Root Hints alone?
-
@Dashrender - You generally rely on one or the other. I don't know that it will use both root hints and forwarders.
You do get slightly better performance out of forwarders, but we're talking about miliseconds. Also, if you have multiple DNS servers, you should remember that forwarders are not stored in Active Directory. You would need to configure your forwarders on each of your DNS servers independently.
Root Hints tend to provide more redundancy. While you only see thirteen of them in the list, many of them are distributed geographically and provide their own type of fault tolerance. I believe there are 457 active root DNS servers right now.
The difference in performance is so small that it's really only a matter of preference. You'll get the same result with either. The only real difference is that when you are using Root Hints, you'll perform a series of iterative queries and expect referrals until you get the authoritative server for the domain you're interested in. When you use a forwarder, you're sending a single recursive query to the forwarder and letting that DNS server handle all of the iterative queries and return you the final answer.
Personal preference. I go with the one that requires less configuration and provides more reliability, even if it's at the expense of a few miliseconds on the response time.
-
Yeah, that's what I figured.
Nice write up!
-
@Dashrender Thank you. I made two quick edits. I had originally used "query" in one place and meant to make it plural. Also, I put that Forwarders are not stored in DNS and meant to type Active Directory. I guess DNS was just on my mind.. hehe.
I do believe that Windows DNS Server has an option to use Root Hints if forwarders are not available, so if you ever do use Forwarders, you probably want to turn that feature on as a backup.
-
Your changes were appearing while I was reading it.
I normally have about 6-8 forwarders when I use them so I rarely have an issue. Though if I'm having that kind of issue I probably have bigger problems.
-
I've never had good luck with Root Hints, always odd issues would pop up. But if you use forwarders don't use your ISPs either..
