DCDIAG DNS Failure

Discussion:

DCDIAG DNS Failure

(too old to reply)

dlove106

2006-08-04 05:03:01 UTC

I suspect that DNS issues are causing me to have email messages arrive hours
or even a day late. It does not happen all the time, but does I have
confirmed the problem. I ran dcdiag /test:dns and received the output below.
I am able to successfully query other domains, and everything appears to be
functioning fine. I'm not sure why the test is failing or what caused it.
Without the sometimes slow mail delivery, I would not even know there was a
problem. Any help in troubleshooting the problem would be greatly
appreciated.

DNS is running on a DC in the Parent container; Exchange 2003 server is
located in child domain.

Thanks.

Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\SDSERVER
Starting test: Connectivity
......................... SDSERVER passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\SDSERVER

DNS Tests are running and not hung. Please wait a few minutes...

Running partition tests on : SDSR

Running partition tests on : Schema

Running partition tests on : Configuration

Running enterprise tests on : Shiprepair.com
Starting test: DNS
Test results for domain controllers:

DC: sdserver.SDSR.Shiprepair.com
Domain: SDSR.Shiprepair.com

TEST: Basic (Basc)
Warning: adapter [00000005] HP NC7760 Gigabit Server
Adapter has invalid DNS server: 172.20.100.10 (<name unavailable>)
Error: all DNS servers are invalid

TEST: Records registration (RReg)
Error: Record registrations cannot be found for all the
network adapters

Summary of test results for DNS servers used by the above domain
controllers:

DNS server: 172.20.100.10 (<name unavailable>)
1 test failure on this DNS server
This is not a valid DNS server. PTR record query for the
1.0.0.127.in-addr.arpa. failed on the DNS server 172.20.100.10

Summary of DNS test results:

Auth Basc Forw Del Dyn RReg
Ext

________________________________________________________________
Domain: SDSR.Shiprepair.com
sdserver PASS FAIL n/a n/a n/a FAIL
n/a

......................... Shiprepair.com failed test DNS

--
DLove

randy benson

2006-08-04 06:59:24 UTC

Permalink

... and the others should point to it as primary, too.

Post by dlove106
I suspect that DNS issues are causing me to have email messages arrive hours
or even a day late. It does not happen all the time, but does I have
confirmed the problem. I ran dcdiag /test:dns and received the output below.
I am able to successfully query other domains, and everything appears to be
functioning fine. I'm not sure why the test is failing or what caused it.
Without the sometimes slow mail delivery, I would not even know there was a
problem. Any help in troubleshooting the problem would be greatly
appreciated.
DNS is running on a DC in the Parent container; Exchange 2003 server is
located in child domain.
Thanks.
Domain Controller Diagnosis
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\SDSERVER
Starting test: Connectivity
......................... SDSERVER passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\SDSERVER
DNS Tests are running and not hung. Please wait a few minutes...
Running partition tests on : SDSR
Running partition tests on : Schema
Running partition tests on : Configuration
Running enterprise tests on : Shiprepair.com
Starting test: DNS
DC: sdserver.SDSR.Shiprepair.com
Domain: SDSR.Shiprepair.com
TEST: Basic (Basc)
Warning: adapter [00000005] HP NC7760 Gigabit Server
Adapter has invalid DNS server: 172.20.100.10 (<name unavailable>)
Error: all DNS servers are invalid
TEST: Records registration (RReg)
Error: Record registrations cannot be found for all the
network adapters
Summary of test results for DNS servers used by the above domain
DNS server: 172.20.100.10 (<name unavailable>)
1 test failure on this DNS server
This is not a valid DNS server. PTR record query for the
1.0.0.127.in-addr.arpa. failed on the DNS server 172.20.100.10
Auth Basc Forw Del Dyn RReg
Ext
________________________________________________________________
Domain: SDSR.Shiprepair.com
sdserver PASS FAIL n/a n/a n/a FAIL
n/a
......................... Shiprepair.com failed test DNS
--
DLove

randy benson

2006-08-04 07:03:35 UTC

Permalink

Sorry wrong thread. My bad.

Post by randy benson
... and the others should point to it as primary, too.

Jorge Silva

2006-08-04 16:48:21 UTC

Permalink

Hi

Can you describe a little more about network config:

-Did you monitored the exchange (Memory,CPU,DISK,SMTP Queues,virtual
memory,etc)?
-Exchange configuration (NIC Properties).
-Existent DNS servers and its configuration.
-How the mail is being delivered to Exchange.
-DNS structure.
-Etc.
--
I hope that the information above helps you

Good Luck
Jorge Silva
MCSA
Systems Administrator

dlove106

2006-08-04 18:49:02 UTC

Permalink

1 AD domain - Parent DC is located in Shiprepair, which is also the sole DNS
server, which has forwarders to our ISP. Child DC has has all member servers
including 2003 exchange. Exchange points to parent dc as preferred dns
server (no alternate). Exchange 2003 is co-existing with Exchange5.5, with
2003 handling both inbound and outbound traffic. Presently, 95% of the
mailboxes still reside in 5.5, which is located in a NT4 domain.

We actually have 2 email addresses, 1 from corporate with DNS handled by
them (Mail working fine), the other handled locally by me (does not route
thru corporate). Incoming mail is forwarded from 2003 Exchange to 5.5
exchange after going thru spam filter.

The DNS structure has a zone configured for the parent domain and a child
zone for the child domain, with the appropriate host, NS, and SOA's in the
parent and host records in the child. Reverse lookup zones are also
configured.

I hope this help. If you need more specifics let me know.

Thanks for the help.
--
DLove

Post by Jorge Silva
Hi
-Did you monitored the exchange (Memory,CPU,DISK,SMTP Queues,virtual
memory,etc)?
-Exchange configuration (NIC Properties).
-Existent DNS servers and its configuration.
-How the mail is being delivered to Exchange.
-DNS structure.
-Etc.
--
I hope that the information above helps you
Good Luck
Jorge Silva
MCSA
Systems Administrator

Jorge Silva

2006-08-05 09:49:26 UTC

Permalink

This sounds more like a Exchange missconfiguration.
to check DNS config:
- Make sure that you configure the Preferred DNS server in TCP/IP properties
on each Domain Controller to use itself as Primary DNS Server (If DC IP
Address is 10.0.0.1 then Dns should be 10.0.0.1).When adding an additional
DC to an existent Domain, do not configure the domain controller to utilize
its own DNS service for name resolution until you have verified that both
inbound and outbound Active Directory replication is functioning and up to
date. During the DCPromo process, you must configure additional domain
controllers to point to another domain controller that is running DNS in
their domain and site, and that hosts the namespace of the domain in which
the new domain controller is installed. More Info here:

Best practices for DNS client settings in Windows 2000 Server and in Windows
Server 2003

http://support.microsoft.com/kb/825036/en-us

- Make sure that every DNS server can resolve all existent domains in the
forest. (You can use Forwarding, Stub Zones or Secondary Zones).

DNS Conditional Forwarding in Windows Server 2003

http://www.windowsnetworking.com/articles_tutorials/DNS_Conditional_Forwarding_in_Windows_Server_2003.html

DNS Stub Zones in Windows Server 2003

http://www.windowsnetworking.com/articles_tutorials/DNS_Stub_Zones.html

How To Create a Child Domain in Active Directory and Delegate the DNS
Namespace to the Child Domain

http://support.microsoft.com/kb/255248/

- Make sure that all clients only use their local(s) Dns Server. Note That
DNS client does not utilize each of the DNS servers listed in TCP/IP
configuration for each query. By default, on startup the DNS client will
attempt to utilize the server in the Preferred DNS server entry. If this
server fails to respond for any reason, the DNS client will switch to the
server listed in the alternate DNS server entry. The DNS client will
continue to use this alternate DNS server until: fails to respond to a DNS
query, or The ServerPriorityTimeLimit value is reached (15 minutes by
default). For more information:

How To Install and Configure DNS Server in Windows Server 2003

http://support.microsoft.com/kb/814591/en-us

Best practices for DNS client settings in Windows 2000 Server and in Windows
Server 2003

http://support.microsoft.com/kb/825036/en-us

How to configure DNS for Internet access in Windows Server 2003

http://support.microsoft.com/kb/323380/en-us

How to configure TCP/IP to use DNS in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;305553
--
I hope that the information above helps you

Good Luck
Jorge Silva
MCSA
Systems Administrator

Post by dlove106
1 AD domain - Parent DC is located in Shiprepair, which is also the sole DNS
server, which has forwarders to our ISP. Child DC has has all member servers
including 2003 exchange. Exchange points to parent dc as preferred dns
server (no alternate). Exchange 2003 is co-existing with Exchange5.5, with
2003 handling both inbound and outbound traffic. Presently, 95% of the
mailboxes still reside in 5.5, which is located in a NT4 domain.
We actually have 2 email addresses, 1 from corporate with DNS handled by
them (Mail working fine), the other handled locally by me (does not route
thru corporate). Incoming mail is forwarded from 2003 Exchange to 5.5
exchange after going thru spam filter.
The DNS structure has a zone configured for the parent domain and a child
zone for the child domain, with the appropriate host, NS, and SOA's in the
parent and host records in the child. Reverse lookup zones are also
configured.
I hope this help. If you need more specifics let me know.
Thanks for the help.
--
DLove

Post by dlove106
I suspect that DNS issues are causing me to have email messages arrive hours
or even a day late. It does not happen all the time, but does I have
confirmed the problem. I ran dcdiag /test:dns and received the output below.
I am able to successfully query other domains, and everything appears
to
be
functioning fine. I'm not sure why the test is failing or what caused it.
Without the sometimes slow mail delivery, I would not even know there
was
a
problem. Any help in troubleshooting the problem would be greatly
appreciated.
DNS is running on a DC in the Parent container; Exchange 2003 server is
located in child domain.
Thanks.
Domain Controller Diagnosis
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\SDSERVER
Starting test: Connectivity
......................... SDSERVER passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\SDSERVER
DNS Tests are running and not hung. Please wait a few minutes...
Running partition tests on : SDSR
Running partition tests on : Schema
Running partition tests on : Configuration
Running enterprise tests on : Shiprepair.com
Starting test: DNS
DC: sdserver.SDSR.Shiprepair.com
Domain: SDSR.Shiprepair.com
TEST: Basic (Basc)
Warning: adapter [00000005] HP NC7760 Gigabit Server
Adapter has invalid DNS server: 172.20.100.10 (<name unavailable>)
Error: all DNS servers are invalid
TEST: Records registration (RReg)
Error: Record registrations cannot be found for all the
network adapters
Summary of test results for DNS servers used by the above domain
DNS server: 172.20.100.10 (<name unavailable>)
1 test failure on this DNS server
This is not a valid DNS server. PTR record query for the
1.0.0.127.in-addr.arpa. failed on the DNS server 172.20.100.10
Auth Basc Forw Del Dyn RReg
Ext
________________________________________________________________
Domain: SDSR.Shiprepair.com
sdserver PASS FAIL n/a n/a n/a FAIL
n/a
......................... Shiprepair.com failed test DNS
--
DLove

dlove106

2006-08-07 15:39:02 UTC

Permalink

Jorge,

I have looked at most of the articles you sited and I have configured DNS
accordingly sometime ago. My clients are pointing to my internal DNS server
only. The DNS server lists only itself as the preferred server with no
alternate. I am not certain about the reverse lookup zone setup as I have 3
entries that seem to refer to the loopback address. I'm not sure which one
is the correct one. They list as follows:

0.0.127.in-addr.arpa (Has NS & SOA records pointing the lone DNS server)

0.in-addr.arpa (Has NS & SOA records pointing the lone DNS server)

127.in-addr.arpa (Has NS & SOA records pointing the lone DNS server) This
one also has a child entry as follows:
0 (Yellow folder with 1 record listed below)
0 (NS record)

I hope this sheds a little more light on what I am seeing and can help in
how to proceed.

Thanks.
--
DLove

Post by Jorge Silva
This sounds more like a Exchange missconfiguration.
- Make sure that you configure the Preferred DNS server in TCP/IP properties
on each Domain Controller to use itself as Primary DNS Server (If DC IP
Address is 10.0.0.1 then Dns should be 10.0.0.1).When adding an additional
DC to an existent Domain, do not configure the domain controller to utilize
its own DNS service for name resolution until you have verified that both
inbound and outbound Active Directory replication is functioning and up to
date. During the DCPromo process, you must configure additional domain
controllers to point to another domain controller that is running DNS in
their domain and site, and that hosts the namespace of the domain in which
Best practices for DNS client settings in Windows 2000 Server and in Windows
Server 2003
http://support.microsoft.com/kb/825036/en-us
- Make sure that every DNS server can resolve all existent domains in the
forest. (You can use Forwarding, Stub Zones or Secondary Zones).
DNS Conditional Forwarding in Windows Server 2003
http://www.windowsnetworking.com/articles_tutorials/DNS_Conditional_Forwarding_in_Windows_Server_2003.html
DNS Stub Zones in Windows Server 2003
http://www.windowsnetworking.com/articles_tutorials/DNS_Stub_Zones.html
How To Create a Child Domain in Active Directory and Delegate the DNS
Namespace to the Child Domain
http://support.microsoft.com/kb/255248/
- Make sure that all clients only use their local(s) Dns Server. Note That
DNS client does not utilize each of the DNS servers listed in TCP/IP
configuration for each query. By default, on startup the DNS client will
attempt to utilize the server in the Preferred DNS server entry. If this
server fails to respond for any reason, the DNS client will switch to the
server listed in the alternate DNS server entry. The DNS client will
continue to use this alternate DNS server until: fails to respond to a DNS
query, or The ServerPriorityTimeLimit value is reached (15 minutes by
How To Install and Configure DNS Server in Windows Server 2003
http://support.microsoft.com/kb/814591/en-us
Best practices for DNS client settings in Windows 2000 Server and in Windows
Server 2003
http://support.microsoft.com/kb/825036/en-us
How to configure DNS for Internet access in Windows Server 2003
http://support.microsoft.com/kb/323380/en-us
How to configure TCP/IP to use DNS in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;305553
--
I hope that the information above helps you
Good Luck
Jorge Silva
MCSA
Systems Administrator

Post by dlove106
I suspect that DNS issues are causing me to have email messages arrive hours
or even a day late. It does not happen all the time, but does I have
confirmed the problem. I ran dcdiag /test:dns and received the output below.
I am able to successfully query other domains, and everything appears
to
be
functioning fine. I'm not sure why the test is failing or what caused it.
Without the sometimes slow mail delivery, I would not even know there
was
a
problem. Any help in troubleshooting the problem would be greatly
appreciated.
DNS is running on a DC in the Parent container; Exchange 2003 server is
located in child domain.
Thanks.
Domain Controller Diagnosis
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\SDSERVER
Starting test: Connectivity
......................... SDSERVER passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\SDSERVER
DNS Tests are running and not hung. Please wait a few minutes...
Running partition tests on : SDSR
Running partition tests on : Schema
Running partition tests on : Configuration
Running enterprise tests on : Shiprepair.com
Starting test: DNS
DC: sdserver.SDSR.Shiprepair.com
Domain: SDSR.Shiprepair.com
TEST: Basic (Basc)
Warning: adapter [00000005] HP NC7760 Gigabit Server
Adapter has invalid DNS server: 172.20.100.10 (<name unavailable>)
Error: all DNS servers are invalid
TEST: Records registration (RReg)
Error: Record registrations cannot be found for all the
network adapters
Summary of test results for DNS servers used by the above domain
DNS server: 172.20.100.10 (<name unavailable>)
1 test failure on this DNS server
This is not a valid DNS server. PTR record query for the
1.0.0.127.in-addr.arpa. failed on the DNS server 172.20.100.10
Auth Basc Forw Del Dyn RReg
Ext
________________________________________________________________
Domain: SDSR.Shiprepair.com
sdserver PASS FAIL n/a n/a n/a FAIL
n/a
......................... Shiprepair.com failed test DNS
--
DLove

Jorge Silva

2006-08-07 22:55:38 UTC

Permalink

Ok, disable the advance view on DNS console, what do you see now?
No zones?
If yes then you can configure one zone, make AD integrated (If the server is
a DC), run ipconfig /registerdns
--
I hope that the information above helps you

Good Luck
Jorge Silva
MCSA
Systems Administrator

Post by dlove106
Jorge,
I have looked at most of the articles you sited and I have configured DNS
accordingly sometime ago. My clients are pointing to my internal DNS server
only. The DNS server lists only itself as the preferred server with no
alternate. I am not certain about the reverse lookup zone setup as I have 3
entries that seem to refer to the loopback address. I'm not sure which one
0.0.127.in-addr.arpa (Has NS & SOA records pointing the lone DNS server)
0.in-addr.arpa (Has NS & SOA records pointing the lone DNS server)
127.in-addr.arpa (Has NS & SOA records pointing the lone DNS server) This
0 (Yellow folder with 1 record listed below)
0 (NS record)
I hope this sheds a little more light on what I am seeing and can help in
how to proceed.
Thanks.
--
DLove

Post by dlove106
I suspect that DNS issues are causing me to have email messages
arrive
hours
or even a day late. It does not happen all the time, but does I have
confirmed the problem. I ran dcdiag /test:dns and received the
output
below.
I am able to successfully query other domains, and everything appears
to
be
functioning fine. I'm not sure why the test is failing or what
caused
it.
Without the sometimes slow mail delivery, I would not even know there
was
a
problem. Any help in troubleshooting the problem would be greatly
appreciated.
DNS is running on a DC in the Parent container; Exchange 2003 server is
located in child domain.
Thanks.
Domain Controller Diagnosis
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\SDSERVER
Starting test: Connectivity
......................... SDSERVER passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\SDSERVER
DNS Tests are running and not hung. Please wait a few minutes...
Running partition tests on : SDSR
Running partition tests on : Schema
Running partition tests on : Configuration
Running enterprise tests on : Shiprepair.com
Starting test: DNS
DC: sdserver.SDSR.Shiprepair.com
Domain: SDSR.Shiprepair.com
TEST: Basic (Basc)
Warning: adapter [00000005] HP NC7760 Gigabit Server
Adapter has invalid DNS server: 172.20.100.10 (<name unavailable>)
Error: all DNS servers are invalid
TEST: Records registration (RReg)
Error: Record registrations cannot be found for all the
network adapters
Summary of test results for DNS servers used by the above domain
DNS server: 172.20.100.10 (<name unavailable>)
1 test failure on this DNS server
This is not a valid DNS server. PTR record query for the
1.0.0.127.in-addr.arpa. failed on the DNS server 172.20.100.10
Auth Basc Forw Del Dyn RReg
Ext
________________________________________________________________
Domain: SDSR.Shiprepair.com
sdserver PASS FAIL n/a n/a n/a FAIL
n/a
......................... Shiprepair.com failed test DNS
--
DLove

dlove106

2006-08-08 15:36:02 UTC

Permalink

--
DLove

Post by Jorge Silva
Ok, disable the advance view on DNS console, what do you see now?
No zones?
If yes then you can configure one zone, make AD integrated (If the server is
a DC), run ipconfig /registerdns

I still see zones after disabling the advance view (Expected?). The only
change is I no longer see 3 of the reverse lookup zones. They are as follows:
0.in-addr.arpa
127.in-addr.arpa
255.in-addr.arpa

So, with advance view I have 4 forward lookup zones and 10 reverse lookup
zones. Without advance view I have 4 forward lookup zones and 7 reverse
lookup zones.

Post by Jorge Silva
--
I hope that the information above helps you
Good Luck
Jorge Silva
MCSA
Systems Administrator

Post by dlove106
I suspect that DNS issues are causing me to have email messages
arrive
hours
or even a day late. It does not happen all the time, but does I have
confirmed the problem. I ran dcdiag /test:dns and received the
output
below.
I am able to successfully query other domains, and everything appears
to
be
functioning fine. I'm not sure why the test is failing or what
caused
it.
Without the sometimes slow mail delivery, I would not even know there
was
a
problem. Any help in troubleshooting the problem would be greatly
appreciated.
DNS is running on a DC in the Parent container; Exchange 2003 server is
located in child domain.
Thanks.
Domain Controller Diagnosis
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\SDSERVER
Starting test: Connectivity
......................... SDSERVER passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\SDSERVER
DNS Tests are running and not hung. Please wait a few minutes...
Running partition tests on : SDSR
Running partition tests on : Schema
Running partition tests on : Configuration
Running enterprise tests on : Shiprepair.com
Starting test: DNS
DC: sdserver.SDSR.Shiprepair.com
Domain: SDSR.Shiprepair.com
TEST: Basic (Basc)
Warning: adapter [00000005] HP NC7760 Gigabit Server
Adapter has invalid DNS server: 172.20.100.10 (<name unavailable>)
Error: all DNS servers are invalid
TEST: Records registration (RReg)
Error: Record registrations cannot be found for all the
network adapters
Summary of test results for DNS servers used by the above domain
DNS server: 172.20.100.10 (<name unavailable>)
1 test failure on this DNS server
This is not a valid DNS server. PTR record query for the
1.0.0.127.in-addr.arpa. failed on the DNS server 172.20.100.10
Auth Basc Forw Del Dyn RReg
Ext
________________________________________________________________
Domain: SDSR.Shiprepair.com
sdserver PASS FAIL n/a n/a n/a FAIL
n/a
......................... Shiprepair.com failed test DNS
--
DLove

Jorge Silva

2006-08-08 18:04:29 UTC

Permalink

Inline

Post by dlove106
0.in-addr.arpa
127.in-addr.arpa
255.in-addr.arpa

- these are loopback related, don't worry.

Post by dlove106
So, with advance view I have 4 forward lookup zones and 10 reverse lookup
zones. Without advance view I have 4 forward lookup zones and 7 reverse
lookup zones.

- are you hosting 4 different domains?
domain01.com, domain02.com,etc?
did you created MX records for the exchange domains that you're hosting?

- 7 reverse lookup zones?
do you need all these reverse zones or your DNS server is multihomed
(multiple NICs)

-Your exchange server that is giving you problems, can it send Mail outside,
or the problem is only to receive Mails?
if the problem is only to receive mails, check that your FW/ROUTER have the
correct ports (SMTP 25TCP) pointing to the exchange server, also make sure
that the FW/ROUTER for your domain has the correct public address.

-If the problem is between the Exchange 5.5 and 2003 you should check the
connectors between them, goto exchange ng they can help you out better.
--
I hope that the information above helps you

Good Luck
Jorge Silva
MCSA
Systems Administrator