DNS going to WAN?

[gstar1703]

Hi,
Windows Server 2003 running DHCP, DNS & WINS which replicates with our remote office working fine until last week. Now for some reason when you attempt to ping any LAN client it returns the external IP of our company website which is hosted on a completely seperate server in the DMZ! If I ipconfig /renew it comes back correctly for several minutes before doing it again.
Our AD domain is named corp.companyname.co.uk & the website to which its resolving through is

http://www.companyname.co.uk!

I have checked DNS, restarted, cleared the cache with no success, and am wondering where this has gone wrong as its worked fine for over a year now. I have our ISP DNS servers set as forwarders but it appears that it looks at these servers for local DNS entries then sees the domain mycompany.co.uk and goes to the external web IP!
Can anyone unravel this mystery?
Thanx

 

[southernhack]

are you using a recursive query?

 

[gstar1703]

Hi,
Dont think so, nothing has changed from the setup when it was working. For whatever reason, its trying to resolve all FQDN to our external DNS servers and bypassing the internal. I have checked hosts files, flushed DNS, registered DNS, rebooted server etc etc. IPCONFIG /ALL looks exactly as it should so I am baffled. I even blocked all traffic on port 53 from LAN to WAN and it still attempted to resolve to the

http://www.companydomain.co.uk

(external ip), so something on the LAN is telling clients to go outside, but what exactly!

Thanx for your time
G

 

[pagy]

Anything in the event logs?

 

[gstar1703]

Hmmm. Just the one entry that relates to DNS as follows:

Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5774
Date: 23/04/2006
Time: 18:25:53
User: N/A
Computer: LANSERVER
Description:
The dynamic registration of the DNS record '_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.corp.GHLplc.co.uk. 600 IN SRV 0 100 389 LanServer.corp.GHLplc.co.uk.' failed on the following DNS server:

DNS server IP address: 217.10.138.210
Returned Response Code (RCODE): 5
Returned Status Code: 9017

For computers and users to locate this domain controller, this record must be registered in DNS.

ADDITIONAL DATA
Error Value: DNS bad key.

I am unsure why my server would registering with 217.10.138.210 as thats an DNS server on the internet..

 

[pagy]

Have a look at this;

http://support.microsoft.com/kb/839505/en-us

or this;

http://support.microsoft.com/kb/284963/en-us

http://support.microsoft.com/kb/266054/en-us

http://support.microsoft.com/kb/259277/en-us

All the above deal with that 5774 event ID.