DNS server not resolving names

[Brad Boles]

Hi Everyone,

The problem:
Two different servers in different networks 1 Active directory integrated the other one not, are both having the same problem with DNS lookups.
The server is configured with dns, setup with forwarders and root hints.
The server network properties point to itself for lookups.
But requests for itself or from clients are both timing out for some domains but not all!
It's crazy you can ping some domains the response is fast while others will just time out.
I can change the servers network dns server to an outside one everything is great for the server.
But a forward to the same server fails.
Could it be a Firewall issue? I have made changes to open up some holes and still no luck.
Any help would be appreciated.

Thanks in advance.
Brad

[Brad Boles]

Update.

I think I found the problem.
The PIX firewall was dropping dns requests that were larger than 512bytes
changed the dns fixup command to 1024bytes
It seems to have solved the problem.
(Should have read more posts first)
more info available at
http://support.microsoft.com/default.aspx?scid=kb;en-us;828731&Product=winsvr2003

If the problem is still there I will repost.

Brad

[Martin H.T. Ngo]

Brad:

This is awesome! Thank you so much for posting this. I
think this is the exact problem I'm having. Some names,
such as www.microsoft.com (I'm not kidding!!!) only
resolve about 5% of the time while every other domain that
I've tried works. I also set up my DNS server to use my
ISP's DNS directly as you did and the problem didn't
happend, so it is definatly something internal. I will try
this fix also.

Cheers,
Martin

[Martin H.T. Ngo]

Update: I tried workaround #2 on the DNS server itself and
that appears to have resolved the problem.

Workaround #2
To work around this problem, turn off EDNS0 support in
Windows Server 2003. To do this, follow these steps:
Start a command prompt.
Type dnscmd /Config /EnableEDnsProbes 0, and then press
ENTER.