To configure a DNS server to use forwarders using the Command Prompt:

1. Open the Command Prompt window with elevated permissions (Run as Administrator).

2. If you want to add the same DNS forwarders used in my previous example, in the Command Prompt window type the following command:

dnscmd <DNS_server_name_or_IP>/ResetForwarders 8.8.8.8 8.8.4.4 /timeout 3 /noslave

Some Final Notes:

• Separate the DNS IP addresses by a space.
• You cannot add individual entries one after the other, you must add all forwarders at the same time in one command. But you can add or change existing entries from DNS Manager.
• The /timeout switch specifies the amount of time that your DNS server waits for the forwarder to respond.
• The /slave switch indicates that the DNS server will not attempt to perform its own iterative queries if the forwarder fails to resolve the query.
• The /noslave switch means that the DNS server will use its root hints file if no forwarders are available to resolve the query.

utilisation d indicateurs racine, lorsqu’aucun forwarders n’est parametre
pour les problemes de resolution dns : verifier firewall pour autoriser messages plus 512octects

EDSN aware
https://spanougakis.wordpress.com/2011/05/01/edns-what-is-all-about-2/
tester sur serveur désactivez la fonctionnalité EDNS0
dnscmd /config /enableednsprobes 0

It looks like the DNS service on Server 2008 R2 by default specifies DNSSEC when submitting DNS requests, while nslookup will not. The default setting for our model of firewall is to block DNS messages larger than 512 bytes and since DNSSEC messages typically exceed this size, they are being blocked.

I’ve asked the network guys to update the firewall configuration to allow the packets. I’ll post again once this change has been made to confirm that this was the cause of the issue.

EDIT: The network guys made the change on the firewall and I’ve confirmed that this was the issue — the servers are now able to successfully resolve using the root hints. The nslookup queries did work because they did not request DNSSEC, whereas the DNS service on 2k8 R2 was requesting it causing the larger DNSSEC responses to get blocked.

Conseil securite : ne pas utiliser les root hint
https://www.stigviewer.com/stig/microsoft_windows_2012_server_domain_name_system/2017-04-06/finding/V-58615

Les étapes pour faire apparaître le nom du serveur DNS :

1. Créer l’enregistrement de type PTR dans la zone de recherche inverse ou se mettre dans proprietes de enregistrement A du DC et cocher mettre a jour enregistrement du ptr associé
2. Sélectionner « obtenir les adresses des serveurs Dns automatiquement » pour l’IPV6
3. Valider le résultat

fix MS sur mon Domaine contrôleur pour préférer l’ipV4 à l’ipV6
http://support.microsoft.com/kb/929852/en-us

DNS Nslookup request timed out
Timeout was 2 secondes.
Default server: Unknown
Address: ::1

———————————————————————-
spyware interfering with proper DNS functionality resulting in intermittent resolution problems. So that’s something you may want to check with a netstat -bn which shows you what programs are using which ports. DNS uses UDP port 53

—————————————————————————-

augmenter le time out niveau forwarders a 10

——————————————————————————-

https://moodjbow.wordpress.com/2011/07/28/dns-request-timed-out-timeout-was-2-seconds-server-unknown/
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ /v DisabledComponents /t REG_DWORD /d 0xff /f
This disables all IPv6 components except for the loopback ::1.

————————————————————————
desinstallation antivirus