Fix Slow External DNS Resolution in Microsoft/Active Directory DNS Server

Aw yaille! I just wrote up a whole explanatory blog post then lost it so this one will likely be brief… or not.

Recently, we found that one of our DNS servers was resolving external hostnames unacceptably slow — about 5 seconds, give or take. The resolution was so slow, in fact, that all of the clients hopped on to the secondary DNS server thinking that the primary had gone down. After logging on to the server to troubleshoot, I could see that:

  1. Pinging external hostnames worked well after the hostname resolved. So did traceroute.
  2. Caching wasn’t working at all
  3. Other AD DNS servers on the network were resolving external hostnames quickly
  4. The root servers were all there but I deleted and reloaded them anyway
        – Note: you can actually load root servers from a root server which is cool
  5. Internal hostname resolution was extremely fast
  6. A reboot didn’t help (you may laugh but this has solved severe AD problems for me)

Because the other AD Servers were picking up the slack, I decided to come back to it later. I went out and had dinner with a friend then returned after a few hours. Upon logging back on to the Internets, an old network admin friend messaged me. I told him what I was seeing and he said he had the exact same issue a few months back.

After a few minutes of trying to recall the solution, he asked “Have you checked your forwarders?” I’d glanced at them but went back to check again. And there it was.. an entry to a machine we’d recently taken down (long story..). I knew the moment I saw the IP that it was the problem. I removed the entry and noticed the forwarded query timeout was equal to drumroll 5 seconds.

To modify your forwarders, open DNS -> Right click on your server -> click Forwarders then Edit.


Finding that solution was impossible on the Internet because of the super general terms: Slow DNS Resolution External Active Directory. Nothing really worked for me so hopefully this post will help others in the future.

Update: A colleague of mine mentioned spyware interfering with proper DNS functionality resulting in intermittent resolution problems. So that’s something you may want to check with a netstat -bn which shows you what programs are using which ports. DNS uses UDP port 53.

Chrissy is a Cloud and Datacenter Management & Data Platform MVP who has worked in IT for over 20 years. She is the creator of the popular SQL PowerShell module dbatools, holds a master's degree in Systems Engineering and is coauthor of Learn dbatools in a Month of Lunches. Chrissy is certified in SQL Server, Linux, SharePoint and network security. You can follow her on Twitter at @cl.

Posted in Active Directory, Networking, Windows
43 comments on “Fix Slow External DNS Resolution in Microsoft/Active Directory DNS Server
  1. hnieef says:

    where can i check forwarders?
    coz my client say very slow when login to AD server
    please help me

  2. dan says:


    Thanks. Been pulling my hair on that one. Installed on a temp IP space and then migrated the DC to a live IP. The old internal IP address was in there.

    Took it out of the forwarder and all is well.

  3. Anthony says:

    Legend! That was a hard problem to google for.

  4. A says:

    Sometimes all it takes is for someone to point out the bloody obvious!
    That’s the problem with having a single person running your IT, no one to bounce ideas and problems around with.

    Thanks :o)

  5. Tyler L says:

    Can you be more specific with the resolution to this problem, we are running into the same thing.

  6. Tyler L says:

    by the way, you are pretty cute!

  7. Ben says:

    Thank You. Thank You. Thank You.

  8. MadAsHell says:

    Throw a guy a bone would you. What is the solution not just “have you checked your forwarders”…..

  9. BigRed says:

    Thanks! I dismissed it at first because I don't normally use forwarders. Not sure how that got in there. I wonder if its a feature in Server 2K8r2 that I was hitherto unaware.

    To MadAsHell: look at your forwarders and make sure they point to valid DNS servers. If that's still Greek to you then go find your server administrator and have him take a look at it.

  10. Darryl says:

    Thanks for this!

  11. Jay says:

    Thanks! I had spent quite a while trying to figure out why some Linux machines (including a new Squid proxy I just built) were running so damn slow. I eventually tracked it to DNS… but it wasn't until I found this and double-checked my forwarders that I found the problem. Oops. :|

  12. Sushispook says:

    OH MY GOD THANK YOU. I was going ape-poo thinking my virtual dc’s were starved for resources, and wondering why they weren’t responding when I allocated more memory and CPU’s to them. Very much appreciated!

  13. Skadaddle says:

    Thank you, Helped a lot.

  14. webmanics says:

    Thanks for the post, I knew there was an issue with DNS and realised that I had removed one of my DNS servers and was still forwarding to it.
    I now have nice quick internet again, That could have been hours of work and it took me 5 min to fix thanks to you.

  15. Guido says:

    Thank you, this post saved my life!

  16. Dante says:

    THANKS George, that's the solution to the problem, GREAT!
    Solucion resuelta segun el comentario de George, solo borren el Dominio que ya no existe en la pestaña de Propiedades, Reenviadores del Servidor DNS

  17. Guest says:

    Oh man. I didn't even set something in the forwarders but you're right! There it was, sitting in the DNS Server Properties>Forwarders tab, the IP address to my old domain controller. Thank you very much! I thought Internet Explorer was just being Internet Explorer…but something was definitely more wrong than usual. Thanks again!

  18. Guest says:

    Thank you so much.

  19. Scott says:

    Thanks for this!

  20. brady says:

    Thank you for posting this! We had such strange and inconsistent results with our DNS we didn't know what it could be. The forwarders timing out was exactly what was going on and you saved us a lot of headache!

  21. jcm says:

    Yep, that was it. Our two old DCs / DNS-servers in the fwd lookup zone. Thing is, I could ‘ve sworn I already deleted them.


  22. Dennis says:

    This has been bugging me for weeks. Thank you!!

  23. Phoenix says:

    THANK YOU THANK YOU THANK YOU!!! You just fixed at least 2 problems(yet to determine how many more) that have been bugging me for a few months.

  24. Gerald Poe says:


    Thanks for the insight. I have a client domain experiencing this exact symptom. They have, after looking, 2-3 defunct IPs in each forward zones, which cannot be deleted, because they do not appear in the config, just in the views.

    They have two locations, dns connected, zone transfers, etc. the speed to resolve is less than stellar and internet access is the 10-20 seconds, presumably because they are using defunct IPs. this is legacy stucc and seems to be unalterable.

    How do we delete the bad entries which are not showing up?



    • Chrissy LeMaire says:

      Hey Gerry,
      That sounds awful. How legacy? Windows NT? I would recommend using PowerShell cmdlets, but it sounds like that may not be an option. Try exploring Dnscmd instead.

  25. Peter says:

    3 days and numerous calls to the ISP of the slow resolution of web pages through SBS DNS server. Only fix was to put the router as DNS in DHCP server scope options on the SBS Server. This worked a treat but broke SBS “CompanyWeb” and Computer “Connect” pages(Who knows Why).

    We had changed ISP’s and the old ISP’s DNS Servers were in the forwarders tab, (interestingly they had stopped resolving) and you guessed it 3 seconds timeout on each. removing them and replacing with new ISP DNS Servers fixed the problem,(Super quick resolution again) Added public as a precaution also.

    Thanks, such a simple fix to a frustrating problem.

  26. S. Smath says:

    Thank a million! This 8-years-old post and informative comment from George saved me and my poor AD. Works like a charm.

  27. Ringmaster says:

    Thanks Chrissy!! You solved my problem!!

  28. Jan says:

    Thank you so much! This solved my problem.

  29. John says:

    What are the forwards supposed to be pointing to? For reference there is a forwarding entry in my secondary DC that points to my primary.

    I have a small home network with a Windows 2012 R2 Essentials DC that is also acting as a DNS Server. All the computers connect to this as primary. Physical machine. I also have a secondary VM that is Windows 2012 R2 Server that is a secondary DC and also secondary Domain Controller. If the primary is offline, all lookups on the net are really slow. Even if I reboot the computer, nslookup still shows the primary as the one being used. I get:

    Even changing the scope of the workstations to look at the secondary first, it doesn’t help. Only difference NSLOOKUP responds correctly but with the secondary DC instead of timing out.



  30. LOL says:

    Nine years so far and still a very pertinent article… I wonder how much time you’ve saved out of our miserable lives combined. Thanks!

  31. asdaHP says:

    I am running server 16 with essentials. Wanted to point out that your write up and one other was very helpful picturing the problem with slow internet that I had. My clients DNS points to the essentials server. The router was also setup with the server IP as first static DNS and with a second backup public DNS. What i didnt realize was that the server was forwarding requests to the router. Net result reallly slow internet probably as things were looping back and forth maybe? I added google DNS as first forwarder on my server and things are better.

    Now do you also suggest that for a home setup that I should place the server’s IP address as primary DNS on the router or should i leave the router to send DNS queries to my internet provider or for that matter google DNS, open DNS etc? Also, what is the recommended time (currently set at 3secs) for the forwarder in the server DNS service?

    thank you!!

  32. Wolfgang says:

    Thank you, I spend lots of time trying to get to the bottom of this. Setting the forwarders did the trick

  33. Sorrento says:

    Great Solution! Thanks!!!

  34. Andy Duncan says:

    Found a forwarder that shouldn’t have been there!!! Great article!

  35. Ben10 says:

    Awesome, Such a life saver

  36. Tom says:

    Thank you! I shut down an old DNS server we had not used for years, and our web browsing got slower, with many failures.
    Turns out our primary DNS server was pointing to the old DNS server for forwarding. Never would have found that without this page.

  37. Bj Griese says:

    Awesome post….quick and to the point….fixed our issue immediately.

  38. Ricky says:

    I had been checking forwarders for weeks trying to figure out why this was happening. All were completely valid. Come to find out that after an update to Windows Server 2008 R2, it caused DNS packets going to forwarders to be too large, even with EDNS disabled. Without knowledge of how to stop the firewall blocking these overly large packets, which are technically malformed anyway, I finally decided to set up the DNS server on the firewall to have forwarders to our ISP’s DNS servers. I then set a single forwarder on the windows DNS server to point to the firewall. Solved the problem immediately after spending weeks trying to fix the issue.

    • Chrissy LeMaire says:

      thanks so much for posting that here to help others with the same problem too, Ricky! glad you finally got it resolved.

  39. John Brines says:

    Fantastic post, saved my bacon.

  40. Victor says:

    This was super helpful! Thank you!

Leave a Reply