Windows Server DNS Server does not Resolve some Names when Forwarders and DNSSEC Validation are configured.

[Peter (FAB)]

I enable DNSSEC validation and configure a forwarder 9.9.9.9 in DNS Manager of Windows 2022.In the DNS Manager I clear the DNS Cache of the Windows DNS Server.I execute the following:nslookup xwkm5qky.r.eu-west-1.awstrack.me. myservernameThe reply is always SERVFAIL.I can see in the network capture that the DNS server is trying to resolve a DS query forxwkm5qky.r.eu-west-1.awstrack.mer.eu-west-1.awstrack.mer.delegate.eu-west-1.awstrack.mecomamazonaws.comThe reply for amazonaws.com is NSEC3 indicating that this zone is not signed. It seems like the DNS server is assuming that the zone awstrack.

Continue reading...