Article ID: 832223 - Last Review: November 15, 2011 - Revision: 6.0

Some DNS name queries are unsuccessful after you deploy a Windows Server 2003 or Windows Server 2008 R2-based DNS server

View products that this article applies to.
System TipThis article applies to a different operating system than the one you are using. Article content that may not be relevant to you is disabled.
Expand all | Collapse all

SYMPTOMS

After you deploy a Windows Server 2003 or Windows Server 2008 R2-based DNS server, DNS queries to some domains may not be resolved successfully.
Back to the top

CAUSE

This issue occurs because of the Extension Mechanisms for DNS (EDNS0) functionality that is supported in Windows Server 2003 DNS.

EDNS0 permits the use of larger User Datagram Protocol (UDP) packet sizes. However, some firewall programs may not permit UDP packets that are larger than 512 bytes. As a result, these DNS packets may be blocked by the firewall.
Back to the top

RESOLUTION

To resolve this issue, update the firewall program to recognize and permit UDP packets that are larger than 512 bytes. For additional information about how to do this, contact the manufacturer of your firewall program.

For information about your hardware manufacturer, visit the following Web site:
http://support.microsoft.com/gp/vendors/en-us (http://support.microsoft.com/gp/vendors/en-us)
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
Back to the top

WORKAROUND

To work around this issue, turn off the EDNS0 feature on Windows Server 2003 and Windows Serve 2008 R2 DNS Servers. To do this, follow these steps:

For Windows Server 2003
  1. Install the Dnscmd.exe program from the Windows Server 2003 Support Tools. To install the Windows Support Tools, right-click Suptools.msi in the Support\Tools folder on the Windows Server 2003 CD-ROM, and then click Install. Follow the steps in the Windows Support Tools Setup Wizard to complete the installation of the Windows Support Tools.
  2. At a command prompt, type the following command, and then press ENTER:
    dnscmd /config /enableednsprobes 0
    Note Type a 0 (zero) and not the letter "O" after "enableednsprobes" in this command.

    The following information appears:
    Registry property enableednsprobes successfully reset.
Command completed successfully.
After you run this command, Windows Server 2003 DNS no longer advertises its EDNS0 capabilities. As a result, the Windows Server 2003 DNS server will not be sent UDP packets that are larger than 512 bytes.

For Windows Server 2008 R2
  • DNSCMD is installed by default on Windows Server 2008 R2 DNS Servers. At a command prompt, type the following command, and then press ENTER: 
    dnscmd /config /enableednsprobes 0

    Note Type a 0 (zero) and not the letter "O" after "enableednsprobes" in this command.
Back to the top

MORE INFORMATION

Some firewalls contain features to check certain parameters of the DNS packet. These firewall features may make sure that the DNS response is smaller than 512 bytes. If you capture the network traffic for an unsuccessful DNS lookup, you may notice that DNS requests EDNS0. Frames that are similar to the following receive no reply:
Additional records
        <Root>: type OPT, class unknown
            Name: <Root>
            Type: EDNS0 option
            UDP payload size: 1280
In this scenario, the firewall may drop all EDNS0-extended UDP frames.
Back to the top
APPLIES TO
  • Windows Server 2008 R2 Datacenter
  • Windows Server 2008 R2 Datacenter without Hyper-V
  • Windows Server 2008 R2 Enterprise
  • Windows Server 2008 R2 Enterprise without Hyper-V
  • Windows Server 2008 R2 Foundation
  • Windows Server 2008 R2 Standard
  • Windows Server 2008 R2 Standard without Hyper-V
  • Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
Back to the top
Keywords: 
kbprb KB832223
Back to the top