Windows Forum

Ask something
Discussion Locked

DNS Resolution for Internet Access

0 helpful
3 replies

by mvesce

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am having an existing issue with resolving DNS for internet access. I have a native 2000 Server Domain setup with internet access with a single DC and single DNS Server. DNS was setup automatically during DCPROMO. Per Microsoft's instructions for setting up DNS, I specified the server's primary DNS Server to point to itself and all existing workstations to point to the server for DNS. The only way I can get internet access to work though is by making the ISP DNS Ip Address the primary DNSNumber on the server and workstations. Internet then works fine. But by doing this Group Policy implementation and Folder Redirection fails. When running into this issue before in other networks in an identical scenario, I found to remove the "."folder in the DNS leaving only the Domain name folder in DNS Forward Lookup Zone. This resolved the issue before. I was told that 2000 Server uses root hint server to resolve internet DNS for there is no need to put the ISP DNS in the list of DNS servers and it has proven to work when removing the "." folder in DNS. Is there a way to manually assign the ISP DNS address in order to resolve internet connectivity. Having the ISP DNS address as secondary DNS Server does not make any difference and only works when making it the primary. I am not too familiar with the Root hint server functionality. Anyone who can shed some light would be appreciated. Thanks

3 replies

by timwalsh

The basic issue is that with the "." zone enabled, your DNS server becomes the root DNS server for your domain. This essentially says that your DNS server is authoritative for all DNS queries inititated with in your domain and will not forward ANY DNS queries outside your domain.

Since you have removed this you have solved the first part of the problem.

Since your server is no longer the the root DNS server, you can now enable and add forwarders. In the DNS admin tool, right click on the server name and choose properties. On the Forwarders tab, check the box labeled "Enable forwarders" and add the IP address for your ISP's DNS server.

You can check the Root Hints tab while you are there and see if there is anything listed. In the Internet DNS world, there are 13 true "Root" DNS servers. These servers are the authoritative servers for the Top Level Domains (TLDs) on the Internet (.com, .org, .edu, etc.). These servers are normally listed by default in the Root Hints tab. If they aren't there, there is no need for concern.

By listing your ISP's DNS server as a forwarder, what you have essentially enabled is this:
Any DNS queries that reference a resource local to your AD domain will be resolved by your DNS server. Any DNS queries that cannot be answered by your server (i.e. resources outside of your domain - the Internet) will be forwarded to your ISP's DNS server for resolution.

Do not add the ISP's DNS server as the Alternate DNS server in TCP/IP properties. The Alternate DNS server will only be queried if the Primary is not available, not if the Primary can't resolve the query.

Hope this helps.

by mvesce

Thanks a lot Tim. Not only is the problem resolved but you provided plenty of detail which cleared some confusion i had as well. Thanks again

This discussion is closed to new replies.