Loading DNS zones fails on a Windows Server 2008 R2-based DNS server

This article describes an issue in which a Windows Server 2008 R2 Service Pack 1 (SP1)-based DNS server that has Active Directory–integrated zones fails to load DNS zones. An update is available to fix this issue. Before you install this update, see the Prerequisites section.
Symptoms
This issue occurs after you have either security update 3100465 or hotfix 3022780 installed on a server that's running Windows Server 2008 R2.
How to get this update
Important If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Add language packs to Windows.

Method 1: Windows Update

This update is provided as a Recommended update on Windows Update. For more information on how to run Windows Update, see How to get an update through Windows Update.

Method 2: Microsoft Update Catalog

To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

Known issue 1

After you install update KB3145126, you may experience crashes of the DNS service. In this scenario, an event that resembles the following is logged in the Application log:

Log Name:      <Application> Source:        <Application Error> Event ID:      1000Task Category: (100)Level:         ErrorKeywords:      ClassicUser:          N/ADescription:Faulting application name: dns.exe, version: 6.1.7601.23375Faulting module name: dns.exe, version: 6.1.7601.23375Exception code: 0xc0000005Faulting application path: C:\Windows\system32\dns.exeFaulting module path: C:\Windows\system32\dns.exe

Cause

This DNS service crash may occur if DNS is configured to have a CNAME and an SOA record that both exist for the "@" record. The "@" record identifies the root of a DNS zone. This can frequently be identified in the DNS Manager as a record with the <same as parent folder> name. The SOA and NS records are allowed in this folder. RFC 2181 describes name uniqueness checks for CNAME records. According to RFC 2181, the CNAME may not exist in the <same as parent name> folder ("@") of a zone.

Resolution

To avoid this issue, identify and remove the "@" CNAME record that's causing the issue from the misconfigured zone before you install update KB3145126. 

To help identify problematic zones, run the following sample PowerShell script. PowerShell is installed by default in Windows Server 2008 R2.

$count = 0$var = get-wmiobject -query "select * from win32_service where name = 'dns'"  if ($var -ne $null) {     if ($var.state.tolower() -eq "running")     {         [array] $global:badcnamedomains = $null         $var = get-wmiobject -namespace "root\microsoftdns" -query "select * from microsoftdns_zone"         if ($var -ne $null)         {              foreach ($var2 in $var)             {                 $query = "select * from microsoftdns_cnametype where containername = '" + $var2.name + "'"                  $var3 = get-wmiobject -namespace "root\microsoftdns" -query $query | where {$_.ownername -eq $var2.name}                 if ($var3 -ne $null)                 {                     $count += 1                     $global:badcnamedomains += $var3.domainname                 }             }         }         else         {             write-host "No zones returned"         }     }     else     {         Write-Host "DNS Service is not running"         break;     } }if ($count -gt 0) {     write-host "Total number of zones found: $count"     write-host "The zones are:"     write-host $global:badcnamedomains  } elseif ($count -eq 0) {     write-host "No zones found with the issue" } $count = $null $global:badcnamedomains = $null
This script will identify CNAME records that conflict with SOA records in locally held DNS zones. If you see a “DNS Service is not running” message when you run the PowerShell script, make sure that the DNS service is started before you run the script. You may have to uninstall the KB3145126 update first to make the DNS service stable.

To delete the CNAME records that do not comply with RFC 2181 based on the output that's returned from the PowerShell script, type the following command at command prompt, and then press Enter:

DNSCMD /recorddelete DNS zone name @ cname
 
Detailed update information

Prerequisites

To install this update, install Service Pack 1 for Windows Server 2008 R2.

Registry information

To apply this update, you don't have to make any changes to the registry.

Restart requirement

You may have to restart the computer after you apply this update.

Update replacement information

This update doesn't replace a previously released update.
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
References
Learn about the terminology that Microsoft uses to describe software updates.
File information
The English (United States) version of this software update installs files that have the attributes that are listed in the following tables.

Windows Server 2008 R2

Notes
  • The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
    Version Product Milestone Service branch
    6.1.760 1.23 xxxWindows Server 2008 R2 SP1 LDR
  • GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
  • The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed in the "Additional file information" section. MUM, MANIFEST, and the associated security catalog (.cat) files, are very important to maintain the state of the updated components. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.
x64 Windows Server 2008 R2
File nameFile versionFile sizeDateTimePlatform
Cache.dnsNot applicable3,19803-Jun-201520:15Not applicable
Dns.exe6.1.7601.23375700,41609-Mar-201617:58x64
Dnsserver.events.xmlNot applicable60903-Jun-201520:15Not applicable

Additional file information

x64 Windows Server 2008 R2
File propertyValue
File nameAmd64_07b49916ed76e55ab4e7ff188a15ff4e_31bf3856ad364e35_6.1.7601.23375_none_996a024c287e6f39.manifest
File versionNot applicable
File size710
Date (UTC)10-Mar-2016
Time (UTC)19:50
PlatformNot applicable
File nameAmd64_microsoft-windows-dns-server-service_31bf3856ad364e35_6.1.7601.23375_none_ac7575300681bfe0.manifest
File versionNot applicable
File size157,939
Date (UTC)09-Mar-2016
Time (UTC)20:04
PlatformNot applicable
File nameUpdate.mum
File versionNot applicable
File size1,671
Date (UTC)10-Mar-2016
Time (UTC)19:50
PlatformNot applicable
Properties

Article ID: 3145126 - Last Review: 10/27/2016 07:31:00 - Revision: 11.0

Windows Server 2008 R2 Service Pack 1

  • kbsurveynew kbfix kbexpertiseadvanced atdownload KB3145126
Feedback