Since upgrading my Windows 2000 DNS servers to Windows Server 2003, I can't access certain Web sites. At first I thought I had a corrupt root cache, but replacing the cache didn't resolve the problem. Plus, I can ping the Web sites. I'm puzzled. Do you have an idea about what could be causing this problem?
The answer is probably a conflict between your firewall and Windows 2003's built-in Extension Mechanisms for DNS. EDNS is enabled by default in Windows 2003 and permits the use of UDP packets larger than 512KB to improve performance. Unfortunately, many firewalls don't permit such large UDP packets and, as a consequence, deny or discard them. To resolve this issue, you can see whether your firewall vendor has a software update that addresses the problem, or you can disable EDNS. Disabling EDNS is usually the easiest route and generally won't hurt the server's performance or operation.
To disable EDNS, you must first install the dnscmd.exe command-line tool from the Windows 2003 CD-ROM's Support Tools. Then, open a command prompt and type
dnscmd /config /enableednsprobes 0
To reenable EDNS if you later obtain a patch from your firewall vendor, run the same command but use 1 instead of 0 at the end of the command string. For more information about EDNS and Microsoft's implementation of it, see Internet Engineering Task Force (IETF) Request for Comments (RFC) 2671 (http://www.ietf.org/rfc/rfc2671.txt?number=2671) or the Microsoft site "Using Extension Mechanisms for DNS (EDNS0)" at http://www.microsoft.com/resources/documentation/windowsserv/2003/standard/proddocs/en-us/sag_dns_imp_ednssupport.asp.