Hello LQ,

I have a local dns server in my 10.x.x.x lan which has a few local name records configured. I also use dhcp to give out my local dns server as the first dns entry. The second is 75.75.75.75(comcast's public dns).

My issue is that sometimes I can't resolve the local servers that are in my dns. It happens intermittently and I've used wireshark to confirm that the problem is that the dns requests sometimes go directly to 75.75.75.75. Why does the second entry get used intermittently?

A simple fix is to remove the 75.75.75.75 server from dhcp but then I'm prone to complete failure when the dns server is rebooting or down. I thought that the second entry would only be used if the first was unreachable for a sufficiently long period of time (say 2 seconds or so.)

Am I right or wrong here?

Interesting details for the folks to consider are thus:
1. The DNS server is Windows Server 2008R2. It has very few errors in its logs, however there are a few which state that the remote endpoint terminated the connection.
2. The resolution problem only has happened to our people using Mac OS X, Debian or Ubuntu. The windows users have not had an issue.
3. The wireshark captures were done on Ubuntu.

How have you assigned the DNS servers? Do you use /etc/resolv.conf? Or are you using the DNS1/DNS2 stanzas in your ifconfig files?

The DNS servers are given out by DHCP so they are auto added to /etc/resolv.conf.

You can disable peerdns by the key 'PEERDNS=no', and add 'DNS1=' and 'DNS2=' in the ifcfg-ethX files, if you want them statically assigned.