Domain Suffix added to DNS Queries

Question

I have a reoccurring DNS problem that has been plaguing our users, occasionally causing their laptops to append our company's domain to the end of all DNS queries. The problem only occurs when users are off site and it appears to be fairly random. It will work one day and then, out of the blue, it will show the invalid entry. This effects mostly Windows XP users but has recently been seen on Vista as well. Here is an example using nslookup.

C:\Users\Username>nslookup www.yahoo.com Server: Linksys Address: 192.168.0.1

Non-authoritative answer: Name: www.yahoo.com.MYDOMAIN.COM Address: 999.999.999.999

I have replaced the IP address that is reported with a placeholder but I can tell you that what it returns is the default *. entry on our Network Solutions configuration. Since obvious www.yahoo.com.MYDOMAIN.COM doesn't exist this makes since. I believe the users internal equipment is functioning properly. Internally we run a Windows 2k3 Active Directory w/ Windows based DHCP and DNS servers. Eventually the problem resolves itself usually over a couple of hours or a number of reboots.

Has anyone seen this behavior before?

Solution 1

The default behavior of nslookup is to append domain suffixes to your query. It will do that until it gets an answer to some question.

It appears that you probably had temporary network disconnection. the host then tried to resolve a name and since it could not resolve www.yahoo.com it started adding known domains suffixes to it. You should see www.yahoo.com.SUBDOMAIN.MYDOMAIN.COM, www.yahoo.com.MYDOMAIN.COM and www.yahoo.com.COM

When all works correctly (network and DNS server) this should not be a problem.

Solution 2

I've had the same problem with Win XP. I fixed it by installing "Portable DNS Cache and Firewall" and specifying the rule to block "*.com.mydomain.com". This blocks all the queries for ".com" domains that are attempted to be resolved as you company's subdomains.