DNS Resolution fails for non-domain joined machines

[vladker]

Hello all,

 

I am experiencing a weird issue with 2003 DNS. (DISCLAIMER: I know very little about DNS).

 

- I am unable to resolve any of my servers on clients that are not joined to the domain.

- I can ping my DNS/DC via name, but any other hosts (e.g. servers) fail unless by ip address.

 

- NSLOOKUPs fail to resolve ANY names. I cant even resolve the name of the DNS server itself:

*** Can't find the server name for address 10.x.x.x: Non-existent domain

(Then attempts to use master DNS server at council datacenter and fails to resolve)

 

- Performing the same on a doimain joined machine:

*** Can't find the server name for address 10.x.x.x: Non-existent domain

(But attempt to resolve by master DNS succeeds)

 

- NSLOOKUP non-domain joined forcing query against my dns:

*** Can't find the server name for address 10.x.x.x: Non-existent domain

Fails to resolve

 

- NSLOOKUP as above, on domain joined:

*** Can't find the server name for address 10.x.x.x: Non-existent domain

Resolves the name correctly.

 

 

Now I have had a good look on the dns server. All looks ok, nothing in the logs of any interest. Entries for relevant servers exist. This is a new job which I have picked up the existing infrastructure.

 

Any help would be most greatfully appreciated.

[kmount]

Check what your DHCP server domain is on the non domain joined client and see if that matches.

 

Could be that your DHCP is passing out bob.com and when you need internallan.internal so the items you're looking up are being looked up as item.bob.com instead of item.internallan.internal

[vladker]

Stupid question ... :-) How do I check this ?

 

If you mean in address leases, name = computername.correctdomain.

[Jamo]

Stupid question ... :-) How do I check this ?

 

If you mean in address leases, name = computername.correctdomain.

 

Basically if your servers netbios name is SERVER1

 

Its DNS name will be SERVER1.domain.suffix like SERVER1.contoso.lan or similar.

 

Test by pinging those names in your non domain joined machines

[vladker]

Thanks,

 

OK, I am able to ping my servers using SERVER1.domain.suffix on non-joined machine.

 

I also tried an NSLOOKUP using the same. Interestingly, the name was resolved by the master DNS server, but my DNS server still refuses to resolve it !?

[Jamo]

Can be because your DNS servers only respond to domain clients?

 

See if anonomous logon is added to the security permissions of your forward lookup zone

[vladker]

I have applied "Anonomous Logon" to the forward lookup, and I have checked that the permission has propogated onto the particular record that I am looking to resolve. Unfortunately, this appears to have had no affect :-) I assume I don't need to restart the service etc ?

[Jamo]

You would still need to resolve the fullname plus domain suffix even after you have allowed anon logon readonly on the zone

[corysober]

I'm sure you figured this out by now, but just in case not. In DHCP, go to the top of your scope and right click it. Go to PROPERTIES, then click the NETWORK ACCESS PROTECTION TAB. Make sure it's disabled. This will allow non domain computers to authenticate through to your DNS server.