Professional Geek
RSS icon Email icon Bullet (black)
  • DNS Server Can’t Resolve Against Itself

    Posted on December 6th, 2017 Andy Parkes No comments

    What an exciting, eye catching headline!

    We took a call from a potentially new customer who were unhappy with their current support provider.

    I went to take a look at the system and the main technical issues they were describing all seemed to be DNS related.

    There were immediately several things that jumped out to me that would cause problems with DNS resolution so I was understandably confident of getting to the bottom of the issues.

    So prospect becomes customer. We do some work to fix various bits and pieces and all appears well.

    Until…

    Couple of nights ago our monitoring agent reported the Domain Controller was offline.

    So I logged onto the server and immediately spotted that the monitoring agent was having trouble resolving DNS.

    I couldn’t find anything in the event log that pointed to a problem, other computers and servers were able to do DNS fine but the domain controller itself was unable to do any name resolution against itself.

    After doing various troubleshooting steps I eventually rebooted the server, everything came up and was working fine. So I left it at that though I was fully expecting it to happen again because I hadn’t actually changed anything.

    What I’d initially thought were the cause of the DNS issues were clearly only part of the problem.

    Fast forward a couple of days and the same thing happened again.

    So I duly logged on and confirmed exactly the same thing

    Name resolution was fine for everything else but the domain controller couldn’t resolve anything internally or externally against it’s itself. Everything just timed out. DNS1

    Since the DNS server was operating fine for other devices I connected to an external DNS server using nslookup just to check the DNS client itself was ok. That worked without issue.

    I then used nslookup against the loopback address (127.0.0.1)

    DNS resolved fine that way too.

    Feeling a little confused I double checked all the things I’d previously identified could be a DNS issue. Everything seemed in order on that front.

    I was just about to restart the server again when I remembered there was something on the server that was a bit of an unknown to me – the anti-virus.

    Specifically what was unknown to me was the product

    They were using MalwareBytes Premium. (version 3.0.5)

    MBP

    Now I’m fully aware of what MalwareBytes is but I’ve never seen it installed on a server. I am aware they have paid for home and business products but my experience is limited to the free home product.

    So I disabled the software.

    DNS returned to normal!

    I enabled the software. DNS fell over again.

    So after a bit of trial an error it turned out to be this setting

    Web Protection

    MBP2

    Kind of makes sense. Like a lot of anti-virus products it intercepts your DNS request, passes it to their own DNS servers and checks to see if the website you are trying to visit is on their block lists.

    Why this issues only surfaced every couple of days I’m not sure (and I only saw it twice..so I don’t know if there is any pattern to it)

    But the secondary issue is that MalwareBytes Premium isn’t even supported on server operating systems (2012 R2 in this case)

    So the fact it’s causing a problem isn’t a surprise

    MBP3

    I also found it specifically mentioned on their support forum

    MBP4

    According to that they shouldn’t have even been able to install it on the server so that’s kind of interesting all by itself.

    So as it’s not supported I’ve removed it from the server.

    Server has been fine since!

    The following two tabs change content below.
    Andy Parkes is Technical Director at Coventry based IT support company IBIT Solutions. He is also Microsoft Partner Area Lead for 2012-2013 and coordinates AMITPRO which is a peer group for IT Professionals in the Midlands area. He also isn't a fan of describing himself in the third person.

    Latest posts by Andy Parkes (see all)

    Leave a Reply