Fix Slow External DNS Resolution in Microsoft/Active Directory DNS Server

Aw yaille! I just wrote up a whole explanatory blog post then lost it so this one will likely be brief… or not.

Recently, we found that one of our DNS servers was resolving external hostnames unacceptably slow — about 5 seconds, give or take. The resolution was so slow, in fact, that all of the clients hopped on to the secondary DNS server thinking that the primary had gone down. After logging on to the server to troubleshoot, I could see that:

1. Pinging external hostnames worked well after the hostname resolved. So did traceroute.
2. Caching wasn’t working at all
2. Other AD DNS servers on the network were resolving external hostnames quickly
3. The root servers were all there but I deleted and reloaded them anyway
    - Note: you can actually load root servers from a root server which is cool
4. Internal hostname resolution was extremely fast
5. A reboot didn’t help (you may laugh but this has solved severe AD problems for me)

Because the other AD Servers were picking up the slack, I decided to come back to it later. I went out and had dinner with a friend then returned after a few hours. Upon logging back on to the Internets, an old network admin friend messaged me. I told him what I was seeing and he said he had the exact same issue a few months back. After a few minutes of trying to recall the solution, he asked “Have you checked your forwarders?” I’d glanced at them but went back to check again. And there it was.. an entry to a machine we’d recently taken down (long story..). I knew the moment I saw the IP that it was the problem. I removed the entry and noticed the forwarded query timeout was equal to *drumroll* 5 seconds.

Finding that solution was impossible on the Internet because of the super general terms: Slow DNS Resolution External Active Directory. Nothing really worked for me so hopefully this post will help others in the future.

Update: A colleague of mine mentioned spyware interfering with proper DNS functionality resulting in intermittent resolution problems. So that’s something you may want to check with a netstat -bn which shows you what programs are using which ports. DNS uses UDP port 53.

Posted in Active Directory, Networking, Windows
21 comments on “Fix Slow External DNS Resolution in Microsoft/Active Directory DNS Server
  1. hnieef says:

    where can i check forwarders?
    coz my client say very slow when login to AD server
    please help me

  2. dan says:

    Dude.

    Thanks. Been pulling my hair on that one. Installed on a temp IP space and then migrated the DC to a live IP. The old internal IP address was in there.

    Took it out of the forwarder and all is well.

  3. Anthony says:

    Legend! That was a hard problem to google for.

  4. A says:

    Sometimes all it takes is for someone to point out the bloody obvious!
    That’s the problem with having a single person running your IT, no one to bounce ideas and problems around with.

    Thanks :o)

  5. Tyler L says:

    Can you be more specific with the resolution to this problem, we are running into the same thing.

  6. Tyler L says:

    by the way, you are pretty cute!

  7. Ben says:

    Thank You. Thank You. Thank You.

  8. MadAsHell says:

    Throw a guy a bone would you. What is the solution not just “have you checked your forwarders”…..

  9. BigRed says:

    Thanks! I dismissed it at first because I don't normally use forwarders. Not sure how that got in there. I wonder if its a feature in Server 2K8r2 that I was hitherto unaware.

    To MadAsHell: look at your forwarders and make sure they point to valid DNS servers. If that's still Greek to you then go find your server administrator and have him take a look at it.

  10. Darryl says:

    Thanks for this!

  11. Jay says:

    Thanks! I had spent quite a while trying to figure out why some Linux machines (including a new Squid proxy I just built) were running so damn slow. I eventually tracked it to DNS… but it wasn't until I found this and double-checked my forwarders that I found the problem. Oops. :|

  12. Sushispook says:

    OH MY GOD THANK YOU. I was going ape-poo thinking my virtual dc’s were starved for resources, and wondering why they weren’t responding when I allocated more memory and CPU’s to them. Very much appreciated!

  13. Skadaddle says:

    Thank you, Helped a lot.

  14. webmanics says:

    Thanks for the post, I knew there was an issue with DNS and realised that I had removed one of my DNS servers and was still forwarding to it.
    I now have nice quick internet again, That could have been hours of work and it took me 5 min to fix thanks to you.

  15. Guido says:

    Thank you, this post saved my life!

  16. Dante says:

    THANKS George, that's the solution to the problem, GREAT!
    Solucion resuelta segun el comentario de George, solo borren el Dominio que ya no existe en la pestaña de Propiedades, Reenviadores del Servidor DNS

  17. Guest says:

    Oh man. I didn't even set something in the forwarders but you're right! There it was, sitting in the DNS Server Properties>Forwarders tab, the IP address to my old domain controller. Thank you very much! I thought Internet Explorer was just being Internet Explorer…but something was definitely more wrong than usual. Thanks again!

  18. Guest says:

    Thank you so much.

  19. Scott says:

    Thanks for this!

  20. brady says:

    Thank you for posting this! We had such strange and inconsistent results with our DNS we didn't know what it could be. The forwarders timing out was exactly what was going on and you saved us a lot of headache!

  21. George says:

    Often in the process of deploying a new server and DNS in an existing
    environment, a bad DNS FORWARDER record gets left behind in your new DNS
    server. The problem doesn't present itself until you decomission the old DNS
    server. Your new DNS server is very slow with external DNS lookups because
    it forwards requests to a DNS server that no longer exists. This process
    eventually falls and finds and alternate DNS path for resolution.

    To correct this problem look for and remove the "dead DNS forwarder" records
    from your new DNS server.

    Open the DNS manager,
    right click on the DNS server and choose properties,
    select the FORWARDERS tab,
    remove and invalid DNS server forwarder records.

    Resolution should be imediate without restart.

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code class="" title="" data-url=""> <del datetime=""> <em> <i> <q cite=""> <strike> <strong> <pre class="" title="" data-url=""> <span class="" title="" data-url="">