dns query reports an A-Record I can't find via GUI (W2K)

[wrtlprmbft]

Hi all,

I have a W2K DNS-server with one forward lookup zone, say sub1.domain.com.
The server answers to an nslookup-query for host.sub2.domain.com (note: it's sub2!) and I can't find the entry for that host (no A-record, no alias, no PTR-record, nothing) in the DNS server management console.
The server does not respond to queries for the IP address of host.sub2.domain.com.
And: There is a two-way trust relationship established between sub1.domain.com and sub2.domain.com.

Any idea, where to find and finally delete this phantom entry??

Thanks in advance,
Ingo

 

[jbud]

I may be missing something in your post, but why is this surprising to you? If you don't have recursion disabled on your nameserver that's authoritative for sub1.domain.com, it's going to query the server authoritative for domain.com to find out who to ask about sub2.domain.com.


If you perform:

C:\>nslookup
> set type=soa

What do you get when you enter sub2.domain.com? This should tell you which nameserver is authoritative for the zone that includes sub2.domain.com.

The server does not respond to queries for the IP address of host.sub2.domain.com.
So you can't perform a ptr (ie, reverse) lookup on the IP? This likely just indicates that the zone or delegation are wrong. Is this an RFC1918-numbered network?

 

[wrtlprmbft]

Hi jbud,

thanks for your reply, and ok, I should have made more clear what happened (sorry):
- Have two dns-servers, called dns1 and dns2, authoritative for sub1.domain.com and sub2.domain.com respectively
- Have a computer, called hostA, which is located in sub2.domain.com
- Recursion on dns1 is disabled; forwarding to some other dns-servers is enabled, but dns2 is not in this list
- Aks dns1 for hostA (short name) and it will answer: "hostA.sub1.domain.com has IPaddress bla..." and this is definitely wrong; neither dns1 nor dns2 have a record that says, hostA is in domain sub1.domain.com.
- Ask dns2 for hostA and it will answer correctly: "hostA.sub2.domain.com has IPaddress bla..."
- A reverse lookup for hostA on dns1 will not find it, which is what I expect.
- Any hostB, hostC, etc. in sub2.domain.com are resolved correctly

Today, the situation is slightly different, and some part of the problem seems to be resolved:
- we cut off the WINS forward lookup
- deleted some obsolete lmhosts-files
Now the forward name resolution is correct for all hosts, but: the reverse lookup for hostA does not resolve to the fqdn, only short name, whereas for all other hosts I get the fqdn hostX.sub2.domain.com

I still suspect some irregularites in WINS:
The two dns-servers dns1 and dns2 were also configured as replicating WINS-servers; I cut off the replication and deleted all WINS-entries for sub2-hosts on dns1 and vice versa.
What I don't understand (maybe I should first read some books on DNS and WINS): &quot;nbtstat -A <IP of hostA>&quot; on dns1 shows a number of entries, even after flushing the cash and waiting a long time for the WINS-servers to delete old entries.

RFC1918: This is not a private network, if that was your question.

 

[GlenJohnson]

How long has this been going on? Setting up a new network? Inherit one with problems? A little more info as to how you got where you are might help us help you. Might be something as simple as a bad hosts file. Good luck.

Glen A. Johnson
&quot;Fall seven times, stand up eight.&quot;
Proverb

Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884

 

[wrtlprmbft]

Glen,

the network is &quot;inherited&quot;, not a new one. DNS and WINS were set up already; in the past, I had trouble establishing a trust relationship between the two domains, therefore I created an lmhosts-file in each domain which solved the problem; after I cleaned up DNS- and WINS-entries in both domains, cut off WINS forward lookup on both DNS-servers, and deleted the replication between the WINS-servers, the lmhosts-files weren't necessary any more, so I deleted them, too. The trust relationship is now ok.

The remaining problem is the following:
A reverse lookup for one particular host, hostA.domain.com, resolves only the short name, whereas for all other hosts I'll get the FQDN.
Why only for that host? I simply don't know where to look for some irregularity.
Second is a question: Why does, on a host in domain1, an &quot;nbtstat -a <IP of a computer in domain2>&quot; answer with a bunch of entries? I thought to have cut off any NetBIOS-relation between the two domains??

any ideas?
Ingo