Hi there,

I have been trying to troubleshoot this issue for sometime now. I have SBS
2003 as PDC, AD, DHCP, and Exchange. Problem Client is Windows xp and
hardware is Dell and in good working order.

The symptoms are at the clients accessing files shares and outlook crashing
and group policies not updating etc.... I have checked dns and appears to be
fine. Errors received at the client side are 1053 and 1054. I can not resolve
computername.domainname.local from the clients.

IP Config of Server;

Windows IP Configuration

Host Name . . . . . . . . . . . . : Servername
Primary Dns Suffix . . . . . . . : domain.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : domain.local

Ethernet adapter Server Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
Physical Address. . . . . . . . . : 00-11-43-10-F8-22
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.0.0.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.0.0.90
Primary WINS Server . . . . . . . : 10.0.0.1

IP Config of Client;

Windows IP Configuration

Host Name . . . . . . . . . . . . : ict-admin
Primary Dns Suffix . . . . . . . : domain.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : doamin.local
domain.local

Ethernet adapter Wireless Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Intel(R) PRO/Wireless 2200BG
Networ
Connection
Physical Address. . . . . . . . . : 00-0E-35-AA-BD-23

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : doamin.local
Description . . . . . . . . . . . : Broadcom 570x Gigabit Integrated
Co
troller
Physical Address. . . . . . . . . : 00-11-43-3A-A0-8D
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 10.0.0.21
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.0.0.90
DHCP Server . . . . . . . . . . . : 10.0.0.1
DNS Servers . . . . . . . . . . . : xxx.xxx.xxx.xxx<<<External DNS

xxx.xxx.xxx.xxx<<<External DNS
Primary WINS Server . . . . . . . : 10.0.0.1
Lease Obtained. . . . . . . . . . : 13 July 2006 11:17:34
Lease Expires . . . . . . . . . . : 21 July 2006 11:17:34

Please !

Regards

AB

I see one problem for sure and two possible, read inline.

Aaron (ireland) wrote:
>
> I have been trying to troubleshoot this issue for sometime now. I
> have SBS 2003 as PDC, AD, DHCP, and Exchange. Problem Client is
> Windows xp and hardware is Dell and in good working order.
>
> The symptoms are at the clients accessing files shares and outlook
> crashing and group policies not updating etc.... I have checked dns
> and appears to be fine. Errors received at the client side are 1053
> and 1054. I can not resolve computername.domainname.local from the
> clients.
>
> IP Config of Server;
>
> Windows IP Configuration
>
> Host Name . . . . . . . . . . . . : Servername
> Primary Dns Suffix . . . . . . . : domain.local
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : domain.local
>
> Ethernet adapter Server Local Area Connection:
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network
> Connection Physical Address. . . . . . . . . : 00-11-43-10-F8-22
> DHCP Enabled. . . . . . . . . . . : No
> IP Address. . . . . . . . . . . . : 10.0.0.1
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 10.0.0.90
> Primary WINS Server . . . . . . . : 10.0.0.1

Being SBS this would be a Domain Controller, and DNS is required for Active
Directory domains. I don't see a DNS address listed in TCP/IP enter this
server's own address 10.0.0.0 for DNS, run these commands. ipconfig
/flushdns, ipconfig /registerdns, net stop netlogon and net start netlogon.

>
> IP Config of Client;
>
> Windows IP Configuration
>
> Host Name . . . . . . . . . . . . : ict-admin
> Primary Dns Suffix . . . . . . . : domain.local
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : doamin.local
> domain.local
>
> Ethernet adapter Wireless Network Connection:
>
> Media State . . . . . . . . . . . : Media disconnected
> Description . . . . . . . . . . . : Intel(R) PRO/Wireless
> 2200BG Networ
> Connection
> Physical Address. . . . . . . . . : 00-0E-35-AA-BD-23
>
> Ethernet adapter Local Area Connection:
>
> Connection-specific DNS Suffix . : doamin.local
> Description . . . . . . . . . . . : Broadcom 570x Gigabit
> Integrated Co
> troller
> Physical Address. . . . . . . . . : 00-11-43-3A-A0-8D
> Dhcp Enabled. . . . . . . . . . . : Yes
> Autoconfiguration Enabled . . . . : Yes
> IP Address. . . . . . . . . . . . : 10.0.0.21
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 10.0.0.90
> DHCP Server . . . . . . . . . . . : 10.0.0.1
> DNS Servers . . . . . . . . . . . :
> xxx.xxx.xxx.xxx<<<External DNS
>
> xxx.xxx.xxx.xxx<<<External DNS

The client has a problem for sure, remove the two external DNS addresses and
enter the SBS IP for DNS, 10.0.0.1 and run ipconfig /flushdns.


--
Best regards,
Kevin D. Goodknecht Sr. [MVP]
Hope This s
===================================
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
===================================
http://www.lonestaramerica.com/
http://support.wftx.us/
https://secure.lsaol.com/
===================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
===================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oe.com/OEBackup/Default.aspx
===================================

Ok all is in working order now what I did was point the primary dns address
of the server to it's own ip but left the external dns as the mail server
cannot send mail unless I use the external dns. Then I modified dhcp to
update cleint's dns to use server as primary dns and also left other dns
entries in place. This has solved all my issue's for now.

Thank you very much.

"Kevin D. Goodknecht Sr. [MVP]" wrote:

>
>
> I see one problem for sure and two possible, read inline.
>
> Aaron (ireland) wrote:
> >
> > I have been trying to troubleshoot this issue for sometime now. I
> > have SBS 2003 as PDC, AD, DHCP, and Exchange. Problem Client is
> > Windows xp and hardware is Dell and in good working order.
> >
> > The symptoms are at the clients accessing files shares and outlook
> > crashing and group policies not updating etc.... I have checked dns
> > and appears to be fine. Errors received at the client side are 1053
> > and 1054. I can not resolve computername.domainname.local from the
> > clients.
> >
> > IP Config of Server;
> >
> > Windows IP Configuration
> >
> > Host Name . . . . . . . . . . . . : Servername
> > Primary Dns Suffix . . . . . . . : domain.local
> > Node Type . . . . . . . . . . . . : Hybrid
> > IP Routing Enabled. . . . . . . . : No
> > WINS Proxy Enabled. . . . . . . . : No
> > DNS Suffix Search List. . . . . . : domain.local
> >
> > Ethernet adapter Server Local Area Connection:
> >
> > Connection-specific DNS Suffix . :
> > Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network
> > Connection Physical Address. . . . . . . . . : 00-11-43-10-F8-22
> > DHCP Enabled. . . . . . . . . . . : No
> > IP Address. . . . . . . . . . . . : 10.0.0.1
> > Subnet Mask . . . . . . . . . . . : 255.255.255.0
> > Default Gateway . . . . . . . . . : 10.0.0.90
> > Primary WINS Server . . . . . . . : 10.0.0.1
>
> Being SBS this would be a Domain Controller, and DNS is required for Active
> Directory domains. I don't see a DNS address listed in TCP/IP enter this
> server's own address 10.0.0.0 for DNS, run these commands. ipconfig
> /flushdns, ipconfig /registerdns, net stop netlogon and net start netlogon.
>
> >
> > IP Config of Client;
> >
> > Windows IP Configuration
> >
> > Host Name . . . . . . . . . . . . : ict-admin
> > Primary Dns Suffix . . . . . . . : domain.local
> > Node Type . . . . . . . . . . . . : Hybrid
> > IP Routing Enabled. . . . . . . . : No
> > WINS Proxy Enabled. . . . . . . . : No
> > DNS Suffix Search List. . . . . . : doamin.local
> > domain.local
> >
> > Ethernet adapter Wireless Network Connection:
> >
> > Media State . . . . . . . . . . . : Media disconnected
> > Description . . . . . . . . . . . : Intel(R) PRO/Wireless
> > 2200BG Networ
> > Connection
> > Physical Address. . . . . . . . . : 00-0E-35-AA-BD-23
> >
> > Ethernet adapter Local Area Connection:
> >
> > Connection-specific DNS Suffix . : doamin.local
> > Description . . . . . . . . . . . : Broadcom 570x Gigabit
> > Integrated Co
> > troller
> > Physical Address. . . . . . . . . : 00-11-43-3A-A0-8D
> > Dhcp Enabled. . . . . . . . . . . : Yes
> > Autoconfiguration Enabled . . . . : Yes
> > IP Address. . . . . . . . . . . . : 10.0.0.21
> > Subnet Mask . . . . . . . . . . . : 255.255.255.0
> > Default Gateway . . . . . . . . . : 10.0.0.90
> > DHCP Server . . . . . . . . . . . : 10.0.0.1
> > DNS Servers . . . . . . . . . . . :
> > xxx.xxx.xxx.xxx<<<External DNS
> >
> > xxx.xxx.xxx.xxx<<<External DNS
>
> The client has a problem for sure, remove the two external DNS addresses and
> enter the SBS IP for DNS, 10.0.0.1 and run ipconfig /flushdns.
>
>
> --
> Best regards,
> Kevin D. Goodknecht Sr. [MVP]
> Hope This s
> ===================================
> When responding to posts, please "Reply to Group"
> via your newsreader so that others may learn and
> benefit from your issue, to respond directly to
> me remove the nospam. from my email address.
> ===================================
> http://www.lonestaramerica.com/
> http://support.wftx.us/
> https://secure.lsaol.com/
> ===================================
> Use Outlook Express?... Get OE_Quotefix:
> It will strip signature out and more
> http://home.in.tum.de/~jain/software/oe-quotefix/
> ===================================
> Keep a back up of your OE settings and folders
> with OEBackup:
> http://www.oe.com/OEBackup/Default.aspx
> ===================================
>
>
>

Aaron (ireland) wrote:
> Ok all is in working order now what I did was point the primary dns
> address of the server to it's own ip but left the external dns as the
> mail server cannot send mail unless I use the external dns. Then I
> modified dhcp to update cleint's dns to use server as primary dns and
> also left other dns entries in place. This has solved all my issue's
> for now.

This does not solve your issue, it only temporarily hides it, the DNS client
will stick to a DNS that gives an answer. So if the internal DNS cannot
resolve an external name it will switch to the external DNS and keep using
it until the TCP/IP stack is reset, (default 20 min). During this time the
client will not resolve internal addresses because the external DNS has no
way to resolve anything only your LAN, so it answers NXDOMAIN, which is an
answer the client will accept and it will keep on using the external DNS.

The solution is that ALL internal clients MUST use the internal DNS, period.

If the internal DNS cannot resolve external names, that must be fixed, you
cannot mix DNS servers that cannot resolve every name the client will ever
need resolved.
Check the internal DNS for the existence of a "." (root) forward lookup
zone, if it has one, delete it, this will enable root hints. (Win2k3
actually asks you if you want to enable root hints, click Yes.) You can
optionally enable a forwarder, which I don't like because if it (DNS) uses a
forwarder, DNS usually won't cache NS records unless they are specifically
queried for. By using Root hints, NS records are cached so the internal DNS
knows where to go to get an Authoritative answer the next time a query comes
in for the same domain, even if it is a different host than the previous
query.


--
Best regards,
Kevin D. Goodknecht Sr. [MVP]
Hope This s
===================================
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
===================================
http://www.lonestaramerica.com/
http://support.wftx.us/
https://secure.lsaol.com/
===================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
===================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oe.com/OEBackup/Default.aspx
===================================

Hi Kevin,

It was advised that we use dhcp to provide dns settings such as the external
dns. I never understood why they had us provide client's with external dns
when we use a proxy server. Maybe the installation of a new firewall etc..
will resolve this issue. Then I can remove external dns. See some clients
access pop3 mail from external server's and without having external dns
entries the clients are unable to recieve mail.

Maybe the problem is with ISA 2000 which is due to be upgraded. Any comments
would be great. Thank you.

Regards

AB

"Kevin D. Goodknecht Sr. [MVP]" wrote:

> Aaron (ireland) wrote:
> > Ok all is in working order now what I did was point the primary dns
> > address of the server to it's own ip but left the external dns as the
> > mail server cannot send mail unless I use the external dns. Then I
> > modified dhcp to update cleint's dns to use server as primary dns and
> > also left other dns entries in place. This has solved all my issue's
> > for now.
>
> This does not solve your issue, it only temporarily hides it, the DNS client
> will stick to a DNS that gives an answer. So if the internal DNS cannot
> resolve an external name it will switch to the external DNS and keep using
> it until the TCP/IP stack is reset, (default 20 min). During this time the
> client will not resolve internal addresses because the external DNS has no
> way to resolve anything only your LAN, so it answers NXDOMAIN, which is an
> answer the client will accept and it will keep on using the external DNS.
>
> The solution is that ALL internal clients MUST use the internal DNS, period.
>
> If the internal DNS cannot resolve external names, that must be fixed, you
> cannot mix DNS servers that cannot resolve every name the client will ever
> need resolved.
> Check the internal DNS for the existence of a "." (root) forward lookup
> zone, if it has one, delete it, this will enable root hints. (Win2k3
> actually asks you if you want to enable root hints, click Yes.) You can
> optionally enable a forwarder, which I don't like because if it (DNS) uses a
> forwarder, DNS usually won't cache NS records unless they are specifically
> queried for. By using Root hints, NS records are cached so the internal DNS
> knows where to go to get an Authoritative answer the next time a query comes
> in for the same domain, even if it is a different host than the previous
> query.
>
>
> --
> Best regards,
> Kevin D. Goodknecht Sr. [MVP]
> Hope This s
> ===================================
> When responding to posts, please "Reply to Group"
> via your newsreader so that others may learn and
> benefit from your issue, to respond directly to
> me remove the nospam. from my email address.
> ===================================
> http://www.lonestaramerica.com/
> http://support.wftx.us/
> https://secure.lsaol.com/
> ===================================
> Use Outlook Express?... Get OE_Quotefix:
> It will strip signature out and more
> http://home.in.tum.de/~jain/software/oe-quotefix/
> ===================================
> Keep a back up of your OE settings and folders
> with OEBackup:
> http://www.oe.com/OEBackup/Default.aspx
> ===================================
>
>
>

Aaron (ireland) wrote:
> Hi Kevin,
>
> It was advised that we use dhcp to provide dns settings such as the
> external dns. I never understood why they had us provide client's
> with external dns when we use a proxy server. Maybe the installation
> of a new firewall etc.. will resolve this issue. Then I can remove
> external dns. See some clients access pop3 mail from external
> server's and without having external dns entries the clients are
> unable to recieve mail.

POP3 mail clients such as OE and Outlook will use the DNS in the client
IPConfig for resolution unless it too is using a POP3 proxy, in which case
the proxy resolves the POP3 server's name.
If you use a Proxy, the web browser will get its DNS resolution from the
Proxy server, the only sites that will use the DNS in the client's IPConfig
are the sites that are configured to bypass the Proxy server.

Have you tried nslookup against the internal DNS to resolve the POP3
server's name?
If it can the problem is not DNS, if it cannot, is the a name conflict in
your local DNS server?
What I mean by a name conflict, is the POP3 server's domain name the same as
your internal Active Directory domain name?
If this is the case, there are several of ways to resolve this. First, use
nslookup against the ISP's DNS to resolve your POP3 server's name, like this
nslookup <mailserver'sFQDN.> <IPAddrOfISPDNS> (It is very important to add
the dot after the mail servers' FQDN. to keep nslookup from appending the
DNS suffix search list)

If the mail server's name is an A record or a CNAME that points to an A
record in your public domain, create an A record with the mail server's name
and matching IP in the internal DNS.

If the mail server's record is a CNAME that points to the ISP's mail
server's name, create an identical CNAME in your internal DNS.


> Maybe the problem is with ISA 2000 which is due to be upgraded. Any
> comments would be great. Thank you.

I tried ISA back when it first was released, I didn't understand about
creating the proper rules, so I opted for a different proxy server that had
default rules that worked out of the box. I just never tried ISA again.

You are going to have severe network issues if you use the ISP DNS in TCP/IP
on the client's NIC, all must use the internal DNS.

--
Best regards,
Kevin D. Goodknecht Sr. [MVP]
Hope This s
===================================
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
===================================
http://www.lonestaramerica.com/
http://support.wftx.us/
https://secure.lsaol.com/
===================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
===================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oe.com/OEBackup/Default.aspx
===================================

"Kevin D. Goodknecht Sr. [MVP]" wrote:

> Aaron (ireland) wrote:
> > Hi Kevin,
> >
> > It was advised that we use dhcp to provide dns settings such as the
> > external dns. I never understood why they had us provide client's
> > with external dns when we use a proxy server. Maybe the installation
> > of a new firewall etc.. will resolve this issue. Then I can remove
> > external dns. See some clients access pop3 mail from external
> > server's and without having external dns entries the clients are
> > unable to recieve mail.
>
> POP3 mail clients such as OE and Outlook will use the DNS in the client
> IPConfig for resolution unless it too is using a POP3 proxy, in which case
> the proxy resolves the POP3 server's name.
> If you use a Proxy, the web browser will get its DNS resolution from the
> Proxy server, the only sites that will use the DNS in the client's IPConfig
> are the sites that are configured to bypass the Proxy server.
>
> Have you tried nslookup against the internal DNS to resolve the POP3
> server's name?
Results;
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\username>nslookup mail.company.ie
*** Can't find server name for address 10.0.0.1: Non-existent domain
Server: dns1.cwm.dublin.isp.net
Address: xxx.xx.xxx.xxx

Non-authoritative answer:
Name: mail.compamy.ie
Address: xx.xxx.xxx.xxx <<Public IP


> If it can the problem is not DNS, if it cannot, is the a name conflict in
> your local DNS server?
> What I mean by a name conflict, is the POP3 server's domain name the same as
> your internal Active Directory domain name?

I presume that they are the same as they reside on the same box. I used
something like company.local for internal domain and company.ie for public
domain. To answer your question yes I think they both have the same name.

> If this is the case, there are several of ways to resolve this. First, use
> nslookup against the ISP's DNS to resolve your POP3 server's name, like this
> nslookup <mailserver'sFQDN.> <IPAddrOfISPDNS> (It is very important to add
> the dot after the mail servers' FQDN. to keep nslookup from appending the
> DNS suffix search list)
>
> If the mail server's name is an A record or a CNAME that points to an A
> record in your public domain, create an A record with the mail server's name
> and matching IP in the internal DNS.
>
> If the mail server's record is a CNAME that points to the ISP's mail
> server's name, create an identical CNAME in your internal DNS.
>
>
> > Maybe the problem is with ISA 2000 which is due to be upgraded. Any
> > comments would be great. Thank you.
>
> I tried ISA back when it first was released, I didn't understand about
> creating the proper rules, so I opted for a different proxy server that had
> default rules that worked out of the box. I just never tried ISA again.
>
> You are going to have severe network issues if you use the ISP DNS in TCP/IP
> on the client's NIC, all must use the internal DNS.
>
> --
> Best regards,
> Kevin D. Goodknecht Sr. [MVP]
> Hope This s
> ===================================
> When responding to posts, please "Reply to Group"
> via your newsreader so that others may learn and
> benefit from your issue, to respond directly to
> me remove the nospam. from my email address.
> ===================================
> http://www.lonestaramerica.com/
> http://support.wftx.us/
> https://secure.lsaol.com/
> ===================================
> Use Outlook Express?... Get OE_Quotefix:
> It will strip signature out and more
> http://home.in.tum.de/~jain/software/oe-quotefix/
> ===================================
> Keep a back up of your OE settings and folders
> with OEBackup:
> http://www.oe.com/OEBackup/Default.aspx
> ===================================
>
>
>

Aaron (ireland) wrote:
> "Kevin D. Goodknecht Sr. [MVP]" wrote:
>
>> Aaron (ireland) wrote:
>>> Hi Kevin,
>>>
>>> It was advised that we use dhcp to provide dns settings such as the
>>> external dns. I never understood why they had us provide client's
>>> with external dns when we use a proxy server. Maybe the installation
>>> of a new firewall etc.. will resolve this issue. Then I can remove
>>> external dns. See some clients access pop3 mail from external
>>> server's and without having external dns entries the clients are
>>> unable to recieve mail.
>>
>> POP3 mail clients such as OE and Outlook will use the DNS in the
>> client IPConfig for resolution unless it too is using a POP3 proxy,
>> in which case the proxy resolves the POP3 server's name.
>> If you use a Proxy, the web browser will get its DNS resolution from
>> the Proxy server, the only sites that will use the DNS in the
>> client's IPConfig are the sites that are configured to bypass the
>> Proxy server.
>>
>> Have you tried nslookup against the internal DNS to resolve the POP3
>> server's name?
> Results;
> Microsoft Windows XP [Version 5.1.2600]
> (C) Copyright 1985-2001 Microsoft Corp.
>
> C:\Documents and Settings\username>nslookup mail.company.ie
> *** Can't find server name for address 10.0.0.1: Non-existent domain

The above "***Can't find server name for address 10.0.0.2: Non-existent
domain" is not really an error, that is nslookup doing a reverse lookup on
the 10.0.0.1 DNS server IP address. If you will create a reverse lookup zone
and PTR for the IP this message will go away.

> Server: dns1.cwm.dublin.isp.net
> Address: xxx.xx.xxx.xxx

The above tells me that you have your ISP's DNS in TCP/IP properties, and
like the DNS Client service, nslookup will "Stick" to the DNS server that
replies. It dows not tell me that the internal DNS cannot resolve external
names. You need to remove the ISP's DNS from the TCP/IP settings and use
this command: nslookup mail.company.ie. 10.0.0.1


>
> I presume that they are the same as they reside on the same box. I
> used something like company.local for internal domain and company.ie
> for public domain. To answer your question yes I think they both have
> the same name.

How could they be the same name when the internal domain is company.local
and the public name company.ie?
What do you mean by they are on the same box?


Where is the mail server located?
It is VERY important that all internal clients use only the SBS IP
(10.0.0.1) for DNS only. You cannot allow an ISP DNS in TCP/IP properties on
ANY member of an AD domain, in any position. Then we can work on getting the
internal DNS server resolving internet names if it cannot.

825036 - Best practices for DNS client settings in Windows 2000 Server and
in Windows Server 2003
http://support.microsoft.com/default...825036&sd=RMVP

323380 - HOW TO: Configure DNS for Internet Access in Windows Server 2003
http://support.microsoft.com/default...323380&sd=RMVP

828263 - DNS query responses do not travel through a firewall in Windows
Server 2003:
http://support.microsoft.com/default...828263&sd=RMVP


--
Best regards,
Kevin D. Goodknecht Sr. [MVP]
Hope This s
===================================
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
===================================
http://www.lonestaramerica.com/
http://support.wftx.us/
https://secure.lsaol.com/
===================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
===================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oe.com/OEBackup/Default.aspx
===================================