I’m continually amazed by how much I don’t know and by all the little issues and problems that I encounter in my day to day tasks. You never know what’s going to pop-up.
I recently stumbled over a very poorly configured DNS environment and thought I would share how to not configuring DNS forwarding.
There was a standalone Microsoft domain which had four domain controllers which were set to forward their requests to another pair of Microsoft DNS servers which eventually forwarded those requests to a fairly new Infoblox DNS environment. Upon looking at the Infoblox reports I noticed a number of non-resolvable hostnames at the top of the reports, they outpaced the next domains in the list by several million requests. Assuming that there was some mis-configured application server that was continually pounding the DNS environment I decided to hunt through the logs to see if I could identify the original requestor and get them to clean up their act. I enabled query logging on one of the servers and set out to examine who was making the request. Oddly enough I found that the other three DNS servers were making the request. Ok, I went to the next server and repeated the steps finding that the next server showed that again the other three servers were making the request. I repeated the process on the remaining two servers and found that all the requests for this bad hostname that I could capture weren’t coming from a specific client but were instead coming just from the servers themselves. This isn’t completely odd, the servers themselves can be clients at the same time but the volume of requests was huge and there was nothing running on these servers except for being Microsoft Domain Controllers and Domain Name Services for a very small Microsoft environment.
It wasn’t until I opened the Microsoft DNS server configuration that I was able to piece together what was happening.
The servers were configured all as (multiple) Primary Masters for the internal domains but they had all been configured to use each other as forwarders along with OpenDNS. So in short the configuration was causing a DNS loop for any requests that failed to resolve. A query from a client to WEST-02 would be forwarded to all three DNS servers along with OpenDNS. Those three DNS servers would then forward that query again back to each of the other servers over and over and over. There is no TTL on a DNS query with respect to propagation. A DNS query can be propagated through as many servers as needed. There is a TTL value on the actual DNS record but that value is used in determining the caching lifecycle.
As I understand it a single DNS query for a bad DNS name would continually self propagate in this configuration because the servers would continually try to obtain an answer by looking to the forwarders and since the forwarders were configured to forward to each other you’d end up in a loop scenario.
You should never configure a pair of DNS servers to forward to each other.
Cheers!
Image Credit: airfin
Hello Michael,
First, thank you very much for sharing all of your knowledge with our community. Your blog and forum has helped me, and saved a great deal of time and grief.
This post shows how _not_ to configure DNS forwarding. My question is: how would _you_ configure DNS forwarding using this scenario?
Thanks,
Mark
Thanks for the comment Mark.
You can’t configure two or more DNS servers to act as forwarders for each other, that was the problem in this configuration. If you want to use forwarders you should just configure third-party DNS server as the forwarder such as OpenDNS or Google or any other number of DNS providers.
Cheers!