Internal clients cannot access external partner domains due to DNSSEC validation failures

Question

Internal clients cannot access external partner domains due to DNSSEC validation failures

Certain AField 0

We have internal clients that suddenly cannot access our external partners' resources. This started happening right after a zone key update was performed on the parent registrar. I checked the DNS logs thoroughly and see that DNSSEC validation is failing on our internal DNS servers. I can also run standard queries and see that our internal network and non-DNSSEC resolutions are working perfectly. I checked the internal DNS configurations and no local changes were made.

I suspect we are dealing with stale records and need to clear the DNSSEC validation caches. I have looked into using the Clear-DnsServerCache cmdlet, but I am unsure of the exact parameters to use without causing broader disruptions.

0 comments

1 answer

Your answer

Answer 1

Hello,

You are correct that this is a DNSSEC cache issue. When a parent zone key update occurs, internal DNS servers that perform DNSSEC validation can hold onto stale DS or DNSKEY records, which leads to validation failures until the cache is flushed. Clearing the standard DNS cache with Clear-DnsServerCache alone is not sufficient because DNSSEC maintains its own validation cache.

On Windows Server DNS, you should use:


Clear-DnsServerCache -Force -DnsSecOnly

The -DnsSecOnly parameter ensures that only the DNSSEC validation cache is cleared, leaving the rest of the resolver cache intact. This avoids unnecessary disruption to normal cached lookups. If you want to clear both the DNSSEC and standard cache, you can omit -DnsSecOnly, but in your case targeting DNSSEC is the safer option.

After running the command, restart the DNS Server service to ensure the validator reloads the updated trust anchors and DS records from the parent zone. You can do this with:


Restart-Service DNS

Once complete, re-run a validation test using Resolve-DnsName -Name <partnerdomain> -DnssecOk to confirm that the chain of trust is now valid. If you still see failures, verify that the parent registrar correctly published the new DS record and that your internal DNS servers have the latest root trust anchors (check %systemroot%\System32\dns\trustanchors.dns).

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!HP.