To configure a DNS server to use forwarders using the Command Prompt:

1. Open the Command Prompt window with elevated permissions (Run as Administrator).

2. If you want to add the same DNS forwarders used in my previous example, in the Command Prompt window type the following command:

dnscmd <DNS_server_name_or_IP>/ResetForwarders 8.8.8.8 8.8.4.4 /timeout 3 /noslave

Some Final Notes:

• Separate the DNS IP addresses by a space.
• You cannot add individual entries one after the other, you must add all forwarders at the same time in one command. But you can add or change existing entries from DNS Manager.
• The /timeout switch specifies the amount of time that your DNS server waits for the forwarder to respond.
• The /slave switch indicates that the DNS server will not attempt to perform its own iterative queries if the forwarder fails to resolve the query.
• The /noslave switch means that the DNS server will use its root hints file if no forwarders are available to resolve the query.

utilisation d indicateurs racine, lorsqu’aucun forwarders n’est parametre
pour les problemes de resolution dns : verifier firewall pour autoriser messages plus 512octects

EDSN aware
https://spanougakis.wordpress.com/2011/05/01/edns-what-is-all-about-2/
tester sur serveur désactivez la fonctionnalité EDNS0
dnscmd /config /enableednsprobes 0

It looks like the DNS service on Server 2008 R2 by default specifies DNSSEC when submitting DNS requests, while nslookup will not. The default setting for our model of firewall is to block DNS messages larger than 512 bytes and since DNSSEC messages typically exceed this size, they are being blocked.

I’ve asked the network guys to update the firewall configuration to allow the packets. I’ll post again once this change has been made to confirm that this was the cause of the issue.

EDIT: The network guys made the change on the firewall and I’ve confirmed that this was the issue — the servers are now able to successfully resolve using the root hints. The nslookup queries did work because they did not request DNSSEC, whereas the DNS service on 2k8 R2 was requesting it causing the larger DNSSEC responses to get blocked.

Conseil securite : ne pas utiliser les root hint
https://www.stigviewer.com/stig/microsoft_windows_2012_server_domain_name_system/2017-04-06/finding/V-58615

Les étapes pour faire apparaître le nom du serveur DNS :

1. Créer l’enregistrement de type PTR dans la zone de recherche inverse ou se mettre dans proprietes de enregistrement A du DC et cocher mettre a jour enregistrement du ptr associé
2. Sélectionner « obtenir les adresses des serveurs Dns automatiquement » pour l’IPV6
3. Valider le résultat

fix MS sur mon Domaine contrôleur pour préférer l’ipV4 à l’ipV6
http://support.microsoft.com/kb/929852/en-us

DNS Nslookup request timed out
Timeout was 2 secondes.
Default server: Unknown
Address: ::1

———————————————————————-
spyware interfering with proper DNS functionality resulting in intermittent resolution problems. So that’s something you may want to check with a netstat -bn which shows you what programs are using which ports. DNS uses UDP port 53

—————————————————————————-

augmenter le time out niveau forwarders a 10

——————————————————————————-

https://moodjbow.wordpress.com/2011/07/28/dns-request-timed-out-timeout-was-2-seconds-server-unknown/
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ /v DisabledComponents /t REG_DWORD /d 0xff /f
This disables all IPv6 components except for the loopback ::1.

————————————————————————
desinstallation antivirus

nettoyage des zones dns
https://blogs.techndet.microsoft.com/windows_networking_fr/2013/04/23/fonctionnement-des-enregistrements-dans-des-zones-dns-intgres-active-directory/

 principes de syncronisation dns
https://www.altospam.com/actualite/2011/03/principle-de-synchronisation-dns/

Un exemple d’enregistrement SOA avec la commande nslookup sera :
> nslookup
> set querytype=SOA
> oktey.com
primary name server = ns1.oktey.com
responsible mail addr = info.oktey.com
serial = 2009032780
refresh = 7200 (2 hours)
retry = 1800 (30 mins)
expire = 604800 (7 days)
default TTL = 86400 (1 day)

L’enregistrement SOA de la zone racine est donné par :

> nslookup
> set querytype=SOA
> .
primary name server = a.root-servers.net
responsible mail addr = nstld.verisign-grs.com
serial  = 2011010900
refresh = 1800 (30 mins)
retry   = 900 (15 mins)
expire  = 604800 (7 days)
default TTL = 86400 (1 day)

nslookup
set type=ns
ou test complet
set type=ANY

noms en double dans le dns

1. Ouvrir la console DHCP.
2. Faire un clic droit sur le serveur DHCP et sélectionner “Propriétés”.
3. Aller dans l’onglet “DNS” et cocher la case  “Ignorer les enregistrements A et PTR lorsque le bail est supprimé”.
4. Faire la même chose au niveau de chaque étendue DHCP.

Cela m’a posé deux problèmes :
* Cela a perturbé les équipes de la Hotline pour la prise en main à distance (utilisation de la résolution dns)
* Cela a perturbé le fonctionnement des applications avec console d’administration pour le déploiement des agents (utilisation de la résolution de noms).
http://msreport.free.fr/?p=75
https://support.microsoft.com/fr-fr/help/816592/how-to-configure-dns-dynamic-updates-in-windows-server-2003

indicateurs racines (root hint) et forwarders
resolution des requetes non autoritatives (externes)
https://www.dell.com/support/article/fr/fr/frbsdt1/sln156952/transitaires-dns-vs-indications-de-racine-dans-windows-server?lang=fr