Different response from same Windows DNS server for domain and non-domain machinesCNAME to another domain fails on some office networks, why?Moved DNS and Email Hosting, Now Can't Send/Receive To/From Domains Hosted on Previous HostBlocking nslookup on A recordGlobal Reverse DNS look-ups not workingWindows 2008 dns server can't find his own host nameIntermittent DNS timeoutHow to determine where an IP returned by NSLOOKUP is coming fromWindows 2012 DNS server: proper address resolution on one computer onlyServer 2012R2 DNS server returning SERVFAIL for some AAAA queriespossible to see remaining DNS negative cache for domain?
Why does this if-statement combining assignment and an equality check return true?
What are these arcade games in Ghostbusters 1984?
Binary Search in C++17
Should one buy new hardware after a system compromise?
Make 24 using exactly three 3s
What is the largest (size) solid object ever dropped from an airplane to impact the ground in freefall?
What are the real benefits of using Salesforce DX?
I think I may have violated academic integrity last year - what should I do?
Use backslash or single-quotes for field separation
How to use " shadow " in pstricks?
What is the environment variable XDG_VTNR?
Which is the common name of Mind Flayers?
What does the view outside my ship traveling at light speed look like?
Popcorn is the only acceptable snack to consume while watching a movie
Boss wants me to falsify a report. How should I document this unethical demand?
Compactness of finite sets
Plot twist where the antagonist wins
If a person had control of every single cell of their body, would they be able to transform into another creature?
keyval - function for keyB should act dependent on value of keyA - how to do this?
What is quasi-aromaticity?
Is real public IP Address hidden when using a system wide proxy in Windows 10?
Should breaking down something like a door be adjudicated as an attempt to beat its AC and HP, or as an ability check against a set DC?
How to illustrate the Mean Value theorem?
Count Even Digits In Number
Different response from same Windows DNS server for domain and non-domain machines
CNAME to another domain fails on some office networks, why?Moved DNS and Email Hosting, Now Can't Send/Receive To/From Domains Hosted on Previous HostBlocking nslookup on A recordGlobal Reverse DNS look-ups not workingWindows 2008 dns server can't find his own host nameIntermittent DNS timeoutHow to determine where an IP returned by NSLOOKUP is coming fromWindows 2012 DNS server: proper address resolution on one computer onlyServer 2012R2 DNS server returning SERVFAIL for some AAAA queriespossible to see remaining DNS negative cache for domain?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
This relates to a forward lookup zone added to a Windows DNS server. The zone allows machines to connect directly to a local email server when connected to the LAN. The same address resolves to the external IP when the machines are connected outside the network.
For machines that are members of the domain and connected on the LAN, the forward lookup zone works fine and the LAN IP is returned. However, for machines not on the domain, the same DNS query against the same DNS server resolves to the external IP (non-authoritative). The Windows domain is ad.zxy.com and the forward lookup zone is mailserver.zxy.com.
We need both domain and non-domain machines to receive the same local IP. Any ideas?
Lookup from domain machine:
nslookup
Default Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
> mailserver.zxy.com
Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
Name: mailserver.zxy.com
Address: 192.168.30.3
Lookup from non-domain machine:
nslookup
Default Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
> mailserver.zxy.com
Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
Non-authoritative answer:
Name: mailserver.zxy.com
Address: xx.xx.182.17
nslookup from non-domain with set debug
From non-domain machine
set debug
mailserver.zxy.com
Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
Got answer:
HEADER:
opcode = QUERY, id = 8, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 1, authority records = 3, additional = 0
QUESTIONS:
mailserver.zxy.com, type = A, class = IN
ANSWERS:
-> mailserver.zxy.com
internet address = xx.xx.182.17
ttl = 14389 (3 hours 59 mins 49 secs)
AUTHORITY RECORDS:
-> zxy.com
nameserver = ns1.hosting-services.net.au
ttl = 86389 (23 hours 59 mins 49 secs)
-> zxy.com
nameserver = ns2.hosting-services.net.au
ttl = 86389 (23 hours 59 mins 49 secs)
-> zxy.com
nameserver = ns3.hosting-services.net.au
ttl = 86389 (23 hours 59 mins 49 secs)
Non-authoritative answer:
Got answer:
HEADER:
opcode = QUERY, id = 9, rcode = NOERROR
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1, additional = 0
QUESTIONS:
mailserver.zxy.com, type = AAAA, class = IN
AUTHORITY RECORDS:
-> mailserver.zxy.com
ttl = 3600 (1 hour)
primary name server = fi-svr04-dc.ad.zxy.com
responsible mail addr = hostmaster.ad.zxy.com
serial = 3
refresh = 900 (15 mins)
retry = 600 (10 mins)
expire = 86400 (1 day)
default TTL = 3600 (1 hour)
Name: mailserver.zxy.com
Address: xx.xx.182.17
windows domain-name-system
asked May 13 at 17:19
Troy Troy
63
|
show 9 more comments
This relates to a forward lookup zone added to a Windows DNS server. The zone allows machines to connect directly to a local email server when connected to the LAN. The same address resolves to the external IP when the machines are connected outside the network.
For machines that are members of the domain and connected on the LAN, the forward lookup zone works fine and the LAN IP is returned. However, for machines not on the domain, the same DNS query against the same DNS server resolves to the external IP (non-authoritative). The Windows domain is ad.zxy.com and the forward lookup zone is mailserver.zxy.com.
We need both domain and non-domain machines to receive the same local IP. Any ideas?
Lookup from domain machine:
nslookup
Default Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
> mailserver.zxy.com
Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
Name: mailserver.zxy.com
Address: 192.168.30.3
Lookup from non-domain machine:
nslookup
Default Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
> mailserver.zxy.com
Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
Non-authoritative answer:
Name: mailserver.zxy.com
Address: xx.xx.182.17
nslookup from non-domain with set debug
From non-domain machine
set debug
mailserver.zxy.com
Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
Got answer:
HEADER:
opcode = QUERY, id = 8, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 1, authority records = 3, additional = 0
QUESTIONS:
mailserver.zxy.com, type = A, class = IN
ANSWERS:
-> mailserver.zxy.com
internet address = xx.xx.182.17
ttl = 14389 (3 hours 59 mins 49 secs)
AUTHORITY RECORDS:
-> zxy.com
nameserver = ns1.hosting-services.net.au
ttl = 86389 (23 hours 59 mins 49 secs)
-> zxy.com
nameserver = ns2.hosting-services.net.au
ttl = 86389 (23 hours 59 mins 49 secs)
-> zxy.com
nameserver = ns3.hosting-services.net.au
ttl = 86389 (23 hours 59 mins 49 secs)
Non-authoritative answer:
Got answer:
HEADER:
opcode = QUERY, id = 9, rcode = NOERROR
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1, additional = 0
QUESTIONS:
mailserver.zxy.com, type = AAAA, class = IN
AUTHORITY RECORDS:
-> mailserver.zxy.com
ttl = 3600 (1 hour)
primary name server = fi-svr04-dc.ad.zxy.com
responsible mail addr = hostmaster.ad.zxy.com
serial = 3
refresh = 900 (15 mins)
retry = 600 (10 mins)
expire = 86400 (1 day)
default TTL = 3600 (1 hour)
Name: mailserver.zxy.com
Address: xx.xx.182.17
windows domain-name-system
asked May 13 at 17:19
Troy Troy
63
There are no conditional forwarders.
– Troy
May 13 at 17:28
1
Obviously this is not normal behavior based on your description. Therefore, we have to determine where you have gone wrong. In order to do that, you have to show us exactly what you are doing and seeing. We can’t tell you ANYTHING about your problem based on the details you provided. How do you KNOW the things you are telling us? How are you performing a DNS lookup? How do you KNOW you are querying the proper DNS server? How is the actual zone and A record configured? Provide screenshots and output of commands you are using to prove your point.
– Appleoddity
May 13 at 18:09
The FQDN of the DNS server is different for domain joined and non-domain joined machines, even though the ip address is the same. Are you using DNS Policies with the DNS server?
– joeqwerty
May 13 at 20:04
docs.microsoft.com/en-us/powershell/module/dnsserver/…
– joeqwerty
May 13 at 20:07
No domain DNS policies. A new domain setup for a 10 user office. Pretty standard stuff - nothing out of the ordinary.
– Troy
May 13 at 20:13
|
show 9 more comments
This relates to a forward lookup zone added to a Windows DNS server. The zone allows machines to connect directly to a local email server when connected to the LAN. The same address resolves to the external IP when the machines are connected outside the network.
For machines that are members of the domain and connected on the LAN, the forward lookup zone works fine and the LAN IP is returned. However, for machines not on the domain, the same DNS query against the same DNS server resolves to the external IP (non-authoritative). The Windows domain is ad.zxy.com and the forward lookup zone is mailserver.zxy.com.
We need both domain and non-domain machines to receive the same local IP. Any ideas?
Lookup from domain machine:
nslookup
Default Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
> mailserver.zxy.com
Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
Name: mailserver.zxy.com
Address: 192.168.30.3
Lookup from non-domain machine:
nslookup
Default Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
> mailserver.zxy.com
Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
Non-authoritative answer:
Name: mailserver.zxy.com
Address: xx.xx.182.17
nslookup from non-domain with set debug
From non-domain machine
set debug
mailserver.zxy.com
Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
Got answer:
HEADER:
opcode = QUERY, id = 8, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 1, authority records = 3, additional = 0
QUESTIONS:
mailserver.zxy.com, type = A, class = IN
ANSWERS:
-> mailserver.zxy.com
internet address = xx.xx.182.17
ttl = 14389 (3 hours 59 mins 49 secs)
AUTHORITY RECORDS:
-> zxy.com
nameserver = ns1.hosting-services.net.au
ttl = 86389 (23 hours 59 mins 49 secs)
-> zxy.com
nameserver = ns2.hosting-services.net.au
ttl = 86389 (23 hours 59 mins 49 secs)
-> zxy.com
nameserver = ns3.hosting-services.net.au
ttl = 86389 (23 hours 59 mins 49 secs)
Non-authoritative answer:
Got answer:
HEADER:
opcode = QUERY, id = 9, rcode = NOERROR
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1, additional = 0
QUESTIONS:
mailserver.zxy.com, type = AAAA, class = IN
AUTHORITY RECORDS:
-> mailserver.zxy.com
ttl = 3600 (1 hour)
primary name server = fi-svr04-dc.ad.zxy.com
responsible mail addr = hostmaster.ad.zxy.com
serial = 3
refresh = 900 (15 mins)
retry = 600 (10 mins)
expire = 86400 (1 day)
default TTL = 3600 (1 hour)
Name: mailserver.zxy.com
Address: xx.xx.182.17
windows domain-name-system
asked May 13 at 17:19
Troy Troy
63
This relates to a forward lookup zone added to a Windows DNS server. The zone allows machines to connect directly to a local email server when connected to the LAN. The same address resolves to the external IP when the machines are connected outside the network.
For machines that are members of the domain and connected on the LAN, the forward lookup zone works fine and the LAN IP is returned. However, for machines not on the domain, the same DNS query against the same DNS server resolves to the external IP (non-authoritative). The Windows domain is ad.zxy.com and the forward lookup zone is mailserver.zxy.com.
We need both domain and non-domain machines to receive the same local IP. Any ideas?
Lookup from domain machine:
nslookup
Default Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
> mailserver.zxy.com
Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
Name: mailserver.zxy.com
Address: 192.168.30.3
Lookup from non-domain machine:
nslookup
Default Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
> mailserver.zxy.com
Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
Non-authoritative answer:
Name: mailserver.zxy.com
Address: xx.xx.182.17
nslookup from non-domain with set debug
From non-domain machine
set debug
mailserver.zxy.com
Server: FI-SVR04-DC.ad.zxy.com
Address: 192.168.30.5
Got answer:
HEADER:
opcode = QUERY, id = 8, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 1, authority records = 3, additional = 0
QUESTIONS:
mailserver.zxy.com, type = A, class = IN
ANSWERS:
-> mailserver.zxy.com
internet address = xx.xx.182.17
ttl = 14389 (3 hours 59 mins 49 secs)
AUTHORITY RECORDS:
-> zxy.com
nameserver = ns1.hosting-services.net.au
ttl = 86389 (23 hours 59 mins 49 secs)
-> zxy.com
nameserver = ns2.hosting-services.net.au
ttl = 86389 (23 hours 59 mins 49 secs)
-> zxy.com
nameserver = ns3.hosting-services.net.au
ttl = 86389 (23 hours 59 mins 49 secs)
Non-authoritative answer:
Got answer:
HEADER:
opcode = QUERY, id = 9, rcode = NOERROR
header flags: response, auth. answer, want recursion, recursion avail.
questions = 1, answers = 0, authority records = 1, additional = 0
QUESTIONS:
mailserver.zxy.com, type = AAAA, class = IN
AUTHORITY RECORDS:
-> mailserver.zxy.com
ttl = 3600 (1 hour)
primary name server = fi-svr04-dc.ad.zxy.com
responsible mail addr = hostmaster.ad.zxy.com
serial = 3
refresh = 900 (15 mins)
retry = 600 (10 mins)
expire = 86400 (1 day)
default TTL = 3600 (1 hour)
Name: mailserver.zxy.com
Address: xx.xx.182.17
windows domain-name-system
windows domain-name-system
asked May 13 at 17:19
Troy Troy
63
asked May 13 at 17:19
Troy Troy
63
edited May 15 at 15:03
Troy
asked May 13 at 17:19
Troy Troy
63
asked May 13 at 17:19
Troy Troy
63
asked May 13 at 17:19
Troy Troy
63
63
There are no conditional forwarders.
– Troy
May 13 at 17:28
1
Obviously this is not normal behavior based on your description. Therefore, we have to determine where you have gone wrong. In order to do that, you have to show us exactly what you are doing and seeing. We can’t tell you ANYTHING about your problem based on the details you provided. How do you KNOW the things you are telling us? How are you performing a DNS lookup? How do you KNOW you are querying the proper DNS server? How is the actual zone and A record configured? Provide screenshots and output of commands you are using to prove your point.
– Appleoddity
May 13 at 18:09
The FQDN of the DNS server is different for domain joined and non-domain joined machines, even though the ip address is the same. Are you using DNS Policies with the DNS server?
– joeqwerty
May 13 at 20:04
docs.microsoft.com/en-us/powershell/module/dnsserver/…
– joeqwerty
May 13 at 20:07
No domain DNS policies. A new domain setup for a 10 user office. Pretty standard stuff - nothing out of the ordinary.
– Troy
May 13 at 20:13
|
show 9 more comments
There are no conditional forwarders.
– Troy
May 13 at 17:28
1
Obviously this is not normal behavior based on your description. Therefore, we have to determine where you have gone wrong. In order to do that, you have to show us exactly what you are doing and seeing. We can’t tell you ANYTHING about your problem based on the details you provided. How do you KNOW the things you are telling us? How are you performing a DNS lookup? How do you KNOW you are querying the proper DNS server? How is the actual zone and A record configured? Provide screenshots and output of commands you are using to prove your point.
– Appleoddity
May 13 at 18:09
The FQDN of the DNS server is different for domain joined and non-domain joined machines, even though the ip address is the same. Are you using DNS Policies with the DNS server?
– joeqwerty
May 13 at 20:04
docs.microsoft.com/en-us/powershell/module/dnsserver/…
– joeqwerty
May 13 at 20:07
No domain DNS policies. A new domain setup for a 10 user office. Pretty standard stuff - nothing out of the ordinary.
– Troy
May 13 at 20:13
There are no conditional forwarders.
– Troy
May 13 at 17:28
There are no conditional forwarders.
– Troy
May 13 at 17:28
1
1
Obviously this is not normal behavior based on your description. Therefore, we have to determine where you have gone wrong. In order to do that, you have to show us exactly what you are doing and seeing. We can’t tell you ANYTHING about your problem based on the details you provided. How do you KNOW the things you are telling us? How are you performing a DNS lookup? How do you KNOW you are querying the proper DNS server? How is the actual zone and A record configured? Provide screenshots and output of commands you are using to prove your point.
– Appleoddity
May 13 at 18:09
Obviously this is not normal behavior based on your description. Therefore, we have to determine where you have gone wrong. In order to do that, you have to show us exactly what you are doing and seeing. We can’t tell you ANYTHING about your problem based on the details you provided. How do you KNOW the things you are telling us? How are you performing a DNS lookup? How do you KNOW you are querying the proper DNS server? How is the actual zone and A record configured? Provide screenshots and output of commands you are using to prove your point.
– Appleoddity
May 13 at 18:09
The FQDN of the DNS server is different for domain joined and non-domain joined machines, even though the ip address is the same. Are you using DNS Policies with the DNS server?
– joeqwerty
May 13 at 20:04
The FQDN of the DNS server is different for domain joined and non-domain joined machines, even though the ip address is the same. Are you using DNS Policies with the DNS server?
– joeqwerty
May 13 at 20:04
docs.microsoft.com/en-us/powershell/module/dnsserver/…
– joeqwerty
May 13 at 20:07
docs.microsoft.com/en-us/powershell/module/dnsserver/…
– joeqwerty
May 13 at 20:07
No domain DNS policies. A new domain setup for a 10 user office. Pretty standard stuff - nothing out of the ordinary.
– Troy
May 13 at 20:13
No domain DNS policies. A new domain setup for a 10 user office. Pretty standard stuff - nothing out of the ordinary.
– Troy
May 13 at 20:13
|
show 9 more comments
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f967077%2fdifferent-response-from-same-windows-dns-server-for-domain-and-non-domain-machin%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f967077%2fdifferent-response-from-same-windows-dns-server-for-domain-and-non-domain-machin%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
There are no conditional forwarders.
– Troy
May 13 at 17:28
1
Obviously this is not normal behavior based on your description. Therefore, we have to determine where you have gone wrong. In order to do that, you have to show us exactly what you are doing and seeing. We can’t tell you ANYTHING about your problem based on the details you provided. How do you KNOW the things you are telling us? How are you performing a DNS lookup? How do you KNOW you are querying the proper DNS server? How is the actual zone and A record configured? Provide screenshots and output of commands you are using to prove your point.
– Appleoddity
May 13 at 18:09
The FQDN of the DNS server is different for domain joined and non-domain joined machines, even though the ip address is the same. Are you using DNS Policies with the DNS server?
– joeqwerty
May 13 at 20:04
docs.microsoft.com/en-us/powershell/module/dnsserver/…
– joeqwerty
May 13 at 20:07
No domain DNS policies. A new domain setup for a 10 user office. Pretty standard stuff - nothing out of the ordinary.
– Troy
May 13 at 20:13