Cause:  The Domain Name System (DNS) server is affected by a network failure.

Solution:  Verify that the server computer has a valid functioning network connection. First, check that related client hardware (cables and network adapters) are working properly at the client by using basic network and hardware troubleshooting steps.

If the server hardware appears to be prepared and functioning properly, check that it has network connectivity by using the ping command to contact other computers or routers (such as its default gateway) that are used and available on the same network as the affected DNS servers.

Cause:  The DNS server is reachable through basic network testing, but it is not responding to DNS queries from clients.

Solution:  If the DNS client can ping the DNS server computer, verify that the DNS server is started and able to listen to and respond to client requests. Try using the nslookup command to test whether the server can respond to DNS clients.

For more information, see Start or Stop a DNS Server.

Cause:  The DNS server has been configured to limit service to a specific list of its configured IP addresses. The IP address originally used in testing its responsiveness is not included in this list.

Solution:  If the server was previously configured to restrict the IP addresses for which it responds to queries, it is possible that the IP address that are being used by clients to contact it is not in the list of restricted IP addresses that are permitted to provide service to clients.

Try testing the server for a response again, but specify a different IP address that is known to be in the restricted interfaces list for the server. If the DNS server responds for that address, add the missing server IP address to the list.

Cause:  The DNS server has been configured to disable the use of its automatically created default reverse lookup zones.

Solution:  Verify that automatically created reverse lookup zones have been created for the server or that advanced configuration changes have not been previously made to the server.

By default, DNS servers automatically create the following three standard reverse lookup zones based on Request for Comments (RFC) recommendations.

These zones are created with common IP addresses covered by these zones that are not useful in a reverse lookup search (0.0.0.0, 127.0.0.1, and 255.255.255.255). By being authoritative for the zones corresponding to these addresses, the DNS service avoids unnecessary recursion to root servers to perform reverse lookups on these types of IP addresses.

It is possible, although unlikely, that these automatic zones are not created. This is because disabling the creation of these zones involves advanced manual configuration of the server registry by a user.

To verify that these zones have been created, do the following:

1. Open DNS Manager.
   
   
2. On the View menu, click Advanced.
   
   
3. In the console tree, click Reverse Lookup Zones.
   
   Where?
   
   
   • DNS/applicable DNS server/Reverse Lookup Zones
     
     
4. In the details pane, verify that the following reverse lookup zones are present:
   
   
   • 0.in-addr.arpa
     
     
   • 127.in-addr.arpa
     
     
   • 255.in-addr.arpa
     
     

Cause:  The DNS server is configured to use a nondefault service port, for example, in an advanced security or firewall configuration.

Solution:  Verify that the DNS server is not using a nonstandard configuration.

This is a rare but possible cause. By default, the nslookup command sends queries to targeted DNS servers using User Datagram Protocol (UDP) port 53. If the DNS server is located on another network and is reachable only through an intermediate host (such as a packet-filtering router or proxy server), the DNS server might use a nonstandard port to listen for and receive client requests.

If this situation applies, determine whether any intermediate firewall or proxy server configuration is intentionally used to block traffic on well-known service ports that are used for DNS. If not, you might be able to add such a packet filter to these configurations to permit traffic to standard DNS ports.

Also, check the DNS server event log to see if Event ID 414 or other critical service-related events have occurred that might indicate why the DNS server is not responding.

Cause:  The DNS server provides incorrect data for queries that it answers successfully.

Solution:  Determine the cause of the incorrect data for the DNS server.

Some of the most likely causes include the following:

• Resource records were not dynamically updated in a zone.
  
  
• An error was made when static resource records were manually added or modified in the zone.
  
  
• Stale resource records in the DNS server database that were left from cached lookups or zone records were not updated with current information or removed when they were no longer needed.
  
  

To help prevent the most common types of problems, be sure to first review best practices for tips and suggestions for deploying and managing your DNS servers. Also, follow and use the checklists that are appropriate for installing and configuring DNS servers and clients, based on your deployment needs.

If you are deploying DNS for Active Directory Domain Services (AD DS), note the new directory-integration features. These features can cause some differences for DNS server defaults—when the DNS database is directory-integrated—that differ from the DNS server defaults that are used with traditional file-based storage.

Many DNS server problems start with failed queries at a client. Therefore, it is often a good idea to start there and troubleshoot the DNS client first.

For more information, see Troubleshooting DNS Clients

Cause:  The DNS server does not resolve names for computers or services outside your immediate network, for example, the names of computers or services that are located on external networks or the Internet.

Solution:  The server has a problem with its ability to correctly perform recursion. Recursion is used in most DNS configurations to resolve names that are not located within the configured DNS domain name that is used by the DNS servers and clients.

If a DNS server fails to resolve a name for which it is not authoritative, the cause is usually a failed recursive query. Recursive queries are used frequently by DNS servers to resolve remote names that are delegated to other DNS zones and servers.

For recursion to work successfully, all DNS servers in the path of a recursive query must be able to respond to and forward correct data. If not, a recursive query can fail for any of the following reasons:

• The recursive query times out before it can be completed.
  
  
• A remote DNS server fails to respond.
  
  
• A remote DNS server provides incorrect data.
  
  

Cause:  The DNS server is not configured to use other DNS servers to assist it in resolving queries.

Solution:  Check whether the DNS server can use both forwarders and recursion.

By default, all DNS servers are enabled to use recursion, although the option to disable its use is configurable in DNS Manager to modify advanced server options. The other possible situation in which recursion might be disabled is if the server is configured to use forwarders and recursion has been specifically disabled for that configuration.

	Note
	If you disable recursion on the DNS server, you will not be able to use forwarders on the same server.

For more information, see Configure a DNS Server to Use Forwarders.

Cause:  Current root hints for the DNS server are not valid.

Solution:  Check whether server root hints are valid.

If they are configured and used correctly, root hints should always point to DNS servers that are authoritative for the zone that contains the domain root and top-level domains.

By default, DNS servers are configured to use root hints that are appropriate to your deployment, based on the following available choices when you use DNS Manager to configure a server:

1. If the DNS server is installed as the first DNS server for your network, it is configured as a root server.
   
   For this configuration, root hints are disabled at the server because the server is authoritative for the root zone.
   
   
2. If the installed server is an additional DNS server for your network, you can direct the Configure a DNS Server Wizard to update its root hints from an existing DNS server on the network.
   
   
3. If you do not have other DNS servers on your network but you still need to resolve Internet DNS names, you can use the default root hints file, which includes a list of Internet root servers that are authoritative for the Internet DNS namespace.
   
   

Cause: The DNS server does not have network connectivity to the root servers.

Solution:  Test for connectivity to the root servers.

If root hints appear to be configured correctly, verify that the DNS server that is used in a failed query can ping its root servers by IP address.

If a ping attempt to one root server fails, it might indicate that an IP address for that root server has changed. Reconfiguration of root servers, however, is uncommon.

A more likely cause is a full loss of network connectivity or in some cases, poor network performance on the intermediate network links between the DNS server and its configured root servers. Follow basic TCP/IP network troubleshooting steps to diagnose connections and determine whether this is the problem.

By default, the DNS service uses a recursive time-out of 15 seconds before failing a recursive query. Under normal network conditions, this time-out does not have to be changed. If performance requires it, however, you can increase this value.

To review additional performance-related information for DNS queries, you can enable and use the DNS server debug log file, Dns.log. This log can provide extensive information about some types of service-related events.

Cause: Other problems exist with updating DNS server data, such as an issue that is related to zones or dynamic updates.

Solution:  Determine whether the problem is related to zones. As needed, troubleshoot any issues in this area, such as possible failure of zone transfer.

For more information, see Troubleshooting Dynamic Updates; Troubleshooting zone problems.

Cause:  My problem is not described here.

Solution:  Search TechNet (http://go.microsoft.com/fwlink/?LinkId=170) for the latest technical information that might relate to the problem. If necessary, you can obtain information and instructions that pertain to your problem or issue.

If you are connected to the Internet, the latest operating system updates are available at Microsoft Update (http://go.microsoft.com/fwlink/?LinkId=284).