which order client resolve DNS request

M0L50N · Apr 7, 2022, 3:35 PM

Hi,

I've setup a DHCP server on my pfsense. In that server, I give these DNS servers in that order :
1st IP - DNS filtering server on our network
2nd IP - Domain controller

The DNS filtering server and DC are setup to check ISP if they dont find.

In General / setup, I've put ISP DNS and google to backup

My question : do I have to put ISP DNS in my dhcp server or it will be redundant? What is the servers order the windows 10 client use : begin with 2 DNS server gived by the DHCP and if not resolved will check others DNS in General/setup?

Thanks

bingo600 · Apr 7, 2022, 5:31 PM

@m0l50n

Afaik Windows "fire a DNS request to all known servers".

But you would need to be more informative.

1:
What is the function of the filter DNS ?
Does it just resolve and filter "external lookups" ?

2:
What does the DC know that the filter DNS doesn't

/Bingo

SteveITS · Apr 7, 2022, 5:42 PM

@m0l50n Windows uses the "last one I talked to" DNS as a priority, it doesn't use the configured order. So, for a Windows domain you do not want anything that can't resolve your domain set as a DNS server. That will cause issues like failed logins, slow logins, errors finding servers, group policy errors, etc.

If you have a Windows domain, in the DNS Resolver settings add a Domain Override pointing to each of your DCs. (domain.local -> 192.168.1.3) That will send requests to the Windows servers.

You can of course configure Windows DNS to forward to the pfSense if you want, and set the PCs to use the Windows servers for DNS.

AndyRH · Apr 7, 2022, 5:47 PM

Windows will ask the first DNS server, wait a short time and ask the next. It will proceed down the list in this fashion until an answer is received. The first responding DNS server is moved to the top of the list. The order only changes when there is a new winner. After a time a non-responding DNS server will be last on the list.
I do not remember the wait time, but it is in milliseconds.
I do not know of a way to view the current DNS server order. 'ipconfig /all' will show the order originally given.
Various Unix/Linux OS's are similar, but may have important differences based on the exact flavor.

johnpoz · Apr 7, 2022, 6:23 PM

@m0l50n said in which order client resolve DNS request:

egin with 2 DNS server gived by the DHCP and if not resolved will check others DNS in General/setup?

doesn't work that way. If I get back a nx say for your ad domain, why would I go ask some other ns. The only reason go ask another ns is didn't get any answer.

You should have al your clients go ask your AD. Then your AD would forward to your public dns service that filters.

AndyRH · Apr 7, 2022, 6:31 PM

@johnpoz Correct, I should have added in my response any answer and the OS will stop asking.

TheDarkness · May 18, 2022, 4:53 PM

If you have a Windows AD you need to configure only the IP of the DCs on clients.
Windows with domain could have weird behavior if clients use a non DC DNS server.
You have to configure the DCs to forward to the other DNS servers.
The best approach is having at least 2 DC to have some redundancy, and configure both IPs on clients.