Domain Suffix added to DNS Queries

Question

I have a reoccurring DNS problem that has been plaguing our users, occasionally causing their laptops to append our company's domain to the end of all DNS queries. The problem only occurs when users are off site and it appears to be fairly random. It will work one day and then, out of the blue, it will show the invalid entry. This effects mostly Windows XP users but has recently been seen on Vista as well. Here is an example using nslookup.

C:\Users\Username>nslookup www.yahoo.com Server: Linksys Address: 192.168.0.1

Non-authoritative answer: Name: www.yahoo.com.MYDOMAIN.COM Address: 999.999.999.999

I have replaced the IP address that is reported with a placeholder but I can tell you that what it returns is the default *. entry on our Network Solutions configuration. Since obvious www.yahoo.com.MYDOMAIN.COM doesn't exist this makes since. I believe the users internal equipment is functioning properly. Internally we run a Windows 2k3 Active Directory w/ Windows based DHCP and DNS servers. Eventually the problem resolves itself usually over a couple of hours or a number of reboots.

Has anyone seen this behavior before?

Answer 1

I haven't, but the scenario that comes to mind is that perhaps your systems are trying to determine whether to append the domain suffix by looking to see whether they can retrieve NS records for the .com TLD, and then intermittent network failures are causing false negatives on that check.

Answer 2

It could also be a DHCP/DNS issue. Part of the DHCP reply can include information about the search domain. Typically, the PC would try to guess to see if it needed to append the search domain before sending the query up to the DNS server. Might warrant an investigation as well.

Answer 3

There are still a lot of possibilities, so see if you can narrow it down.

You need to isolate the problem to a specific application on a specific system.

You could have a misconfigured DHCP server (you might be able to compare the lease log on the DHCP server with windows of activity). You might have a badly behaving application, which composes calls to the resolver without an FQDN (which should end in a period). If your first query fails (lets say the DNS request times out), then the resolver might cause a second query where treated your string as a PQDN and literalized it into the longer FQDN you see.

Answer 4

The default behavior of nslookup is to append domain suffixes to your query. It will do that until it gets an answer to some question.

It appears that you probably had temporary network disconnection. the host then tried to resolve a name and since it could not resolve www.yahoo.com it started adding known domains suffixes to it. You should see www.yahoo.com.SUBDOMAIN.MYDOMAIN.COM, www.yahoo.com.MYDOMAIN.COM and www.yahoo.com.COM

When all works correctly (network and DNS server) this should not be a problem.