Basic DNS issues involve a typo in an A record. Advanced DNS troubleshooting involves unpicking the complex web of caching, recursion, and active directory dependencies.
Advanced Scenarios
- Stale Cache: A record was updated, but a client or intermediate recursive server is caching the old IP based on the record's TTL (Time to Live).
- Missing SRV Records: Essential for domain-joined clients to locate domain controllers. If these records are missing, Active Directory authentication fails.
- Split-Horizon DNS: Internal clients receive a private IP for
example.com, while external Internet clients receive a public IP. Troubleshooting requires testing from the correct perspective. - Conditional Forwarding: A DNS server is configured to forward queries for a specific domain (e.g., a partner company) to a specific remote server instead of the standard internet root servers.
Response Codes
When using tools to query DNS, look at the response codes:
- NOERROR: The query succeeded.
- NXDOMAIN: The domain name mathematically does not exist.
- SERVFAIL: The server failed to process the query, often due to a broken forwarder or a DNSSEC validation failure.
- Timeout: The server didn't respond at all (check firewalls or routing).
Advanced Commands
Beyond simple nslookup, use PowerShell to query specific DNS Record Types:
# Check for mail routing records
Resolve-DnsName example.com -Type MX
# Check for AD LDAP service records
Resolve-DnsName _ldap._tcp.dc._msdcs.example.com -Type SRVActive Directory Warning
Do NOT recommend setting a domain-joined Windows client to a public DNS server (like 8.8.8.8) as a generic "fix" for browsing issues. Domain-joined clients absolutely depend on internal Domain Controllers for DNS to authenticate and apply group policies.