Comments on: DNS PTR records inexplicable appearance

By: sonyfreek

sonyfreek — Wed, 11 Jan 2006 22:24:09 +0000

You can’t filter by username because it’s never the user that is requesting the DNS dynamic entry. The computer itself is the one that requests the entry. However, you could filter your logs based on IP Address, as mentioned in this article:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/2a2723c5-3462-411d-94e2-fe5fc08db07b.mspx

Filtering it would allow you to see information from a specific IP Address. Maybe the information in the debug file will tell you what the computer is requesting. Since it’s a PTR record that’s being added, you should have the IP Address as well.

By: petroleumman

petroleumman — Wed, 11 Jan 2006 08:55:25 +0000

Hello,

Does your Linux server have multiple NIC’s? If this is the case check that you don’t have an old IP still assigned to one of the secondary NIC’s. If you do this could be the source of your rouge record in DNS.

Also, check all of your IP settings on the Linux box for any old IP’s that still may be configured. Just because your box is working on the network does not necessarily mean that an old address is not present somewhere.

Good Luck!

By: ralfeus

ralfeus — Wed, 11 Jan 2006 07:40:46 +0000

An owner of that record is SYSTEM. I checked it first of all… Is it possible to log all update requests including username of update initiator and IP address of computer where request was send from?
Thanks
Mykhaylo

By: sonyfreek

sonyfreek — Tue, 10 Jan 2006 17:46:31 +0000

Ralfeus,

Your question is who created the record? If you have your DNS Active Directory integrated, you should be able to look at the properties of the record and see who created it. I’m not sitting at a DNS server right now to test it, but I believe that there are properties on who is the owner. You’ll have to fiddle around with it because I don’t remember how to look at who owns it, but it’s not extremely hard to do.

Hope this helps,
SF

By: richl01

richl01 — Tue, 10 Jan 2006 08:49:13 +0000

check your secondary DNS server to see if the old PTR is being replicated back. , or any other program trying to gain access through IP, including mapped drives.

By: ctyauhk

ctyauhk — Tue, 10 Jan 2006 06:42:32 +0000

I have no solution. But is there any chance you have forgotten a DHCP server which is still leasing the ip address?

By: ralfeus

ralfeus — Mon, 09 Jan 2006 11:04:20 +0000

All names are in lower case only

By: ralfeus

ralfeus — Mon, 09 Jan 2006 11:03:59 +0000

All names are in lower case only

By: tim123

tim123 — Fri, 06 Jan 2006 09:45:35 +0000

We had a problem with DNS records returning if they contain upper case characters. If this is the case you can call microsoft for the fix. This is free

By: ralfeus

ralfeus — Fri, 06 Jan 2006 08:21:56 +0000

The host with such IP address existed, but now it has other address. That computer is Linux box. So, there is no host with IP address, which appear in reverse zone.