Skip to Content

How to Fix DNS Server Errors and Delegation Issues in Windows DC

By: Author Alex Lim

Posted on

Categories Troubleshooting

Learn how to troubleshoot and resolve DNS server errors and delegation issues in Windows domain controllers with this comprehensive guide.

DNS is a critical service for any network that relies on Active Directory. DNS servers are responsible for resolving hostnames to IP addresses and vice versa, as well as providing other information about the domain and its resources. However, DNS servers can also encounter problems that affect their functionality and performance, such as service shutdowns, invalid domain names, broken delegations, and incorrect configuration.

In this article, we will explain how to fix some of the common DNS server errors and delegation issues in Windows domain controllers, and what are the best practices for DNS configuration and maintenance.

DNS Server Service Shutdowns

One of the problems that can affect DNS servers is the random shutdown of the DNS Server service, which prevents the server from responding to DNS queries and updates. This can cause various issues for the domain, such as replication failures, authentication errors, and network connectivity problems. To troubleshoot this problem, you need to check the following:

Event logs

Look for any errors or warnings related to the DNS Server service in the Application, System, and DNS Server logs. These can indicate the cause of the service shutdown, such as a configuration error, a resource exhaustion, a security issue, or a corruption of the DNS database. You can use the Event Viewer tool to view and filter the event logs, or use the Get-WinEvent cmdlet in PowerShell to query the event logs programmatically.

DNS database

Check the integrity and consistency of the DNS database, which is stored in the Active Directory database (for AD-integrated zones) or in the %SystemRoot%\System32\DNS folder (for file-backed zones). You can use the dnscmd /zoneinfo command to view the zone information, or use the DNS Manager console to inspect the zone records. You can also use the dnscmd /enumrecords command to export the zone records to a text file for further analysis. If you suspect that the DNS database is corrupted, you can use the esentutl tool to repair the database, or restore it from a backup.

DNS configuration

Check the configuration of the DNS Server service, such as the listening interfaces, the forwarders, the root hints, the security settings, and the advanced options. You can use the DNS Manager console or the dnscmd command to view and modify the DNS configuration. You can also use the Get-DnsServer and Set-DnsServer cmdlets in PowerShell to manage the DNS configuration. Make sure that the DNS configuration is consistent and correct across all the DNS servers in the domain.

DNS performance

Check the performance of the DNS Server service, such as the memory usage, the CPU usage, the network traffic, the response time, and the query statistics. You can use the Performance Monitor tool or the Get-Counter cmdlet in PowerShell to monitor the DNS performance counters. You can also use the DNS Server Cache tool or the dnscmd /statistics command to view the DNS cache statistics. If the DNS performance is degraded, you can use the DNS Server Scavenging tool or the dnscmd /startscavenging command to clean up the stale records in the DNS database. You can also use the DNS Server Debug Logging tool or the dnscmd /config /enablelogging command to enable the DNS debug logging, which can help you identify and troubleshoot the DNS issues.

Invalid Domain Names in DNS Packets

Another problem that can affect DNS servers is the invalid domain names in DNS packets, which are usually caused by malformed or spoofed DNS queries from external sources. These queries can cause the DNS Server service to log the following error in the DNS Server event log:

DNS-Server-Services. Event ID: 5504

The DNS server encountered an invalid domain name in a packet from 172.62.2.89. The packet will be rejected. The event data contains the DNS packet.

The DNS server encountered an invalid domain name in a packet from 108.152.192.164. The packet will be rejected. The event data contains the DNS packet.

How to Fix DNS Server Errors and Delegation Issues in Windows DC

To troubleshoot this problem, you need to check the following:

DNS packet

Examine the DNS packet that caused the error, which is encoded in hexadecimal format in the event data. You can use the DNSCMD /packetinfo command to decode the DNS packet and display its contents. You can also use a network packet analyzer tool, such as Wireshark, to capture and analyze the DNS packets on the network. Look for any anomalies or inconsistencies in the DNS packet, such as an invalid or non-existent domain name, a wrong query type, a mismatched transaction ID, or a forged source IP address.

DNS source

Identify the source of the DNS packet that caused the error, which is the IP address that is listed in the event message. You can use the ping, tracert, nslookup, or whois commands to obtain more information about the source IP address, such as its hostname, location, owner, and reputation. You can also use a firewall or a router to block or filter the traffic from the source IP address, if it is malicious or unwanted.

DNS security

Implement the security measures to protect the DNS Server service from invalid or malicious DNS packets, such as the following:

  • Enable DNSSEC (DNS Security Extensions) to verify the authenticity and integrity of the DNS data, and to prevent DNS spoofing and cache poisoning attacks. You can use the DNS Manager console or the dnscmd /config /enableednsprobes command to enable the EDNS0 (Extension Mechanisms for DNS) support, which is required for DNSSEC. You can also use the DNSSEC Deployment Planning and DNSSEC Deployment tools or the PowerShell cmdlets in the DnsServer module to configure and manage the DNSSEC settings and operations.
  • Enable DNS Socket Pool to randomize the source port of the DNS queries, and to reduce the risk of DNS cache poisoning attacks. You can use the DNS Manager console or the dnscmd /config /socketpoolsize command to enable and configure the DNS socket pool size.
  • Enable DNS Response Rate Limiting to limit the rate of the DNS responses to the same destination address, and to mitigate the DNS amplification and reflection attacks. You can use the DNS Manager console or the dnscmd /config /responselimit command to enable and configure the DNS response rate limiting settings.

Broken Delegations in DNS Zones

A third problem that can affect DNS servers is the broken delegations in DNS zones, which are usually caused by missing or incorrect NS (Name Server) or A (Host) records in the parent or child zones. A delegation is a mechanism that allows a DNS server to delegate the responsibility of resolving a subdomain to another DNS server. For example, if you have a domain called ds.xyz.com, and a subdomain called DS.ds.xyz.com, you can delegate the DS.ds.xyz.com zone to a different DNS server than the one that hosts the ds.xyz.com zone. However, if the delegation records are not configured properly, the DNS queries for the subdomain will fail or return incorrect results. To troubleshoot this problem, you need to check the following:

DNS zones

Verify the existence and configuration of the parent and child zones that are involved in the delegation. You can use the DNS Manager console or the dnscmd /zoneinfo command to view the zone information, such as the zone type, the replication scope, the start of authority (SOA), and the name servers. You can also use the DNS Manager console or the dnscmd /enumrecords command to view the zone records, such as the NS and A records. Make sure that the parent zone has the correct NS and A records for the child zone, and that the child zone has the correct SOA and NS records for itself.

DNS delegation

Test the functionality and validity of the delegation by using the nslookup or dig commands to query the parent and child zones. You can use the set type=ns or set type=a options to specify the query type, and the server option to specify the DNS server to query. You can also use the set debug or set d2 options to enable the verbose output, which can show the details of the DNS resolution process. Look for any errors or discrepancies in the query results, such as a non-existent or unreachable DNS server, a mismatched or outdated DNS record, or a referral loop or timeout.

DNS delegation fix

Fix the broken delegation by adding, deleting, or modifying the NS and A records in the parent and child zones, as needed. You can use the DNS Manager console or the dnscmd /recordadd, /recorddelete, or /recordupdate commands to manage the zone records. You can also use the PowerShell cmdlets in the DnsServer module to manage the zone records. After making the changes, you need to clear the DNS cache on the DNS servers and clients, and test the delegation again.

Best Practices for DNS Configuration and Maintenance

To prevent or minimize the DNS server errors and delegation issues, you should follow the best practices for DNS configuration and maintenance, such as the following:

DNS server order

Configure the DNS server order on the network adapters of the domain controllers and domain-joined computers, according to the following guidelines:

  • Use only internal DNS servers that are authoritative for the domain. Do not use external DNS servers, such as the ones provided by the ISP or the public DNS services, as they can cause name resolution failures or security risks.
  • Use the DNS servers that are closest to the network location of the computer, preferably in the same Active Directory site, to optimize the performance and availability of the DNS service.
  • Use the loopback address (127.0.0.1) as one of the DNS servers, but not as the first one, to improve the reliability and stability of the DNS service.
  • Use the primary DNS server of the domain as the first DNS server, to ensure the consistency and accuracy of the DNS data.
  • Use at least two DNS servers, preferably in different physical locations, to provide redundancy and fault tolerance for the DNS service.

DNS zone replication

Configure the DNS zone replication scope and frequency, according to the following guidelines:

  • Use Active Directory-integrated zones, instead of file-backed zones, to store the DNS data in the Active Directory database, and to take advantage of the security, replication, and backup features of Active Directory.
  • Use the default replication scope of “All DNS servers in this domain”, unless you have a specific reason to use a custom replication scope, such as “All domain controllers in this domain”, “All domain controllers in this forest”, or “To all domain controllers specified in the scope of this directory partition”.
  • Use the default replication frequency of “Once per hour”, unless you have a specific reason to use a different replication frequency, such as “Every 15 minutes”, “Every 30 minutes”, “Every 2 hours”, or “Every 4 hours”.
  • Use the DNS Notify feature to notify the secondary DNS servers of the changes in the primary DNS server, and to trigger the zone transfer process. You can use the DNS Manager console or the dnscmd /zonerefresh command to configure the DNS Notify settings.

DNS scavenging

Configure the DNS scavenging settings and schedule, according to the following guidelines:

  • Enable the DNS scavenging feature to automatically delete the stale or obsolete records from the DNS database, and to free up the DNS resources and improve the DNS performance. You can use the DNS Manager console or the dnscmd /startscavenging command to enable the DNS scavenging feature.
  • Configure the aging and scavenging settings for the DNS server and the DNS zones, such as the no-refresh interval, the refresh interval, and the scavenging period. You can use the DNS Manager console or the dnscmd /config /aging command to configure the aging and scavenging settings. The recommended values for the aging and scavenging settings are:
    • No-refresh interval: 7 days
    • Refresh interval: 7 days
    • Scavenging period: 7 days
  • Configure the timestamp and scavenging settings for the DNS records, such as the static or dynamic update type, the record timestamp, and the scavenging eligibility. You can use the DNS Manager console or the dnscmd /recordadd, /recorddelete, or /recordupdate commands to configure the timestamp and scavenging settings for the DNS records. The recommended values for the timestamp and scavenging settings for the DNS records are:
    • Static records: Do not update the record timestamp, and do not scavenge the record.
    • Dynamic records: Update the record timestamp when the record is created or modified, and scavenge the record when the record timestamp is older than the sum of the no-refresh interval and the refresh interval.

DNS diagnostics

Perform the DNS diagnostics tests and tools, according to the following guidelines:

  • Use the DCDIAG /TEST:DNS command to test the DNS configuration and functionality of the domain controllers, and to identify and report any DNS errors or warnings. You can use the /v or /e options to enable the verbose or enterprise-wide output, respectively. You can also use the /s, /n, or /f options to specify the domain controller, the domain name, or the output file, respectively.
  • Use the NSLOOKUP or DIG commands to test the DNS resolution and query the DNS records of the DNS servers and domains. You can use the set type, set server, set debug, set d2, or set recurse options to specify the query type, the DNS server, the verbose output, the detailed output, or the recursive query, respectively. You can also use the /query, /xfr, or /ls options to perform the standard query, the zone transfer, or the zone listing, respectively.
  • Use the DNSLint or DNSCMD /EnumZones commands to verify the consistency and integrity of the DNS data across the DNS servers and zones. You can use the /ad or /ql options to enable the Active Directory or the quick list output, respectively. You can also use the /s, /d, or /f options to specify the DNS server, the DNS zone, or the output file, respectively.

Frequently Asked Questions (FAQs)

Question: What is DNS and why is it important?

Answer: DNS stands for Domain Name System, and it is a distributed database that maps hostnames to IP addresses and vice versa, as well as provides other information about the domain and its resources. DNS is important because it allows users and applications to access the network resources by using easy-to-remember names, instead of complex numerical addresses. DNS also enables the load balancing, the fault tolerance, and the security of the network services.

Question: What are the common DNS server errors and delegation issues?

Answer: Some of the common DNS server errors and delegation issues are:

  • DNS Server service shutdowns: The DNS Server service stops running or responding to DNS queries and updates, due to various reasons, such as a configuration error, a resource exhaustion, a security issue, or a corruption of the DNS database.
  • Invalid domain names in DNS packets: The DNS Server service receives malformed or spoofed DNS queries from external sources, which contain invalid or non-existent domain names, and logs an error in the DNS Server event log.
  • Broken delegations in DNS zones: The DNS Server service fails to resolve or returns incorrect results for the subdomains that are delegated to another DNS server, due to missing or incorrect NS or A records in the parent or child zones.

Question: How to fix DNS server errors and delegation issues?

Answer: To fix DNS server errors and delegation issues, you need to check and troubleshoot the following:

  • Event logs: Look for any errors or warnings related to the DNS Server service in the Application, System, and DNS Server logs, and identify the cause of the problem.
  • DNS database: Check the integrity and consistency of the DNS database, and repair or restore it if it is corrupted.
  • DNS configuration: Check the configuration of the DNS Server service, and make sure it is consistent and correct across all the DNS servers in the domain.
  • DNS performance: Check the performance of the DNS Server service, and optimize it by cleaning up the stale records, enabling the DNS debug logging, and monitoring the DNS performance counters and cache statistics.
  • DNS packet: Examine the DNS packet that caused the error, and look for any anomalies or inconsistencies in the packet contents, such as an invalid or non-existent domain name, a wrong query type, a mismatched transaction ID, or a forged source IP address.
  • DNS source: Identify the source of the DNS packet that caused the error, and obtain more information about the source IP address, such as its hostname, location, owner, and reputation. Block or filter the traffic from the source IP address, if it is malicious or unwanted.
  • DNS security: Implement the security measures to protect the DNS Server service from invalid or malicious DNS packets, such as enabling DNSSEC, DNS Socket Pool, and DNS Response Rate Limiting.
  • DNS zones: Verify the existence and configuration of the parent and child zones that are involved in the delegation, and make sure they have the correct zone type, replication scope, start of authority, name servers, and zone records.
  • DNS delegation: Test the functionality and validity of the delegation by querying the parent and child zones, and look for any errors or discrepancies in the query results, such as a non-existent or unreachable DNS server, a mismatched or outdated DNS record, or a referral loop or timeout.
  • DNS delegation fix: Fix the broken delegation by adding, deleting, or modifying the NS and A records in the parent and child zones, as needed. Clear the DNS cache on the DNS servers and clients, and test the delegation again.

Summary

In this article, we have explained how to fix some of the common DNS server errors and delegation issues in Windows domain controllers, and what are the best practices for DNS configuration and maintenance. We have covered the following topics:

  • DNS Server service shutdowns: How to check the event logs, the DNS database, the DNS configuration, and the DNS performance, and how to troubleshoot and resolve the service shutdowns.
  • Invalid domain names in DNS packets: How to check the DNS packet, the DNS source, and the DNS security, and how to troubleshoot and resolve the invalid domain names.
  • Broken delegations in DNS zones: How to check the DNS zones, the DNS delegation, and the DNS delegation fix, and how to troubleshoot and resolve the broken delegations.
  • Best practices for DNS configuration and maintenance: How to configure the DNS server order, the DNS zone replication, the DNS scavenging, and the DNS diagnostics, and how to follow the best practices for DNS configuration and maintenance.

Disclaimer: This article is for informational purposes only and does not constitute professional advice. The author and the publisher are not liable for any damages or losses that may result from the use of the information or the tools in this article. The user is responsible for verifying the accuracy and validity of the information and the tools before applying them to their own environment. The user is also responsible for complying with the applicable laws and regulations regarding the use of the information and the tools in this article. The author and the publisher do not endorse or recommend any products or services that may be mentioned or linked in this article. The user should exercise their own judgment and discretion when using the information and the tools in this article.