DNS lookups timing out

Question

Hello,
I am attempting to deactivate an old DNS server from our network and whenever I turn it off, DNS lookups fail for all clients and the other two DNS servers that I am keeping.
I have checked that the zones have properly replicated and that pointer records exist for both DNS servers.  I have run nslookup on the name servers and the lookup times out twice and then provides the correct IP for the name.  The primary DNS
server is 2008 R2 and the secondary is 2012.  The old server I am trying to deactivate is 2003 and was previously the primary.  I can ping DNS names and IP addresses for both servers with no errors and even ping external names as well.  Yet,
in a browser, dns lookups still fail.  I am sure I am missing something obvious here, but any advice or suggestions on what to look at here would be appreciated.
Thank you,
Josh

Answer 1

So you're saying that if no machines are using the 2003 DNS, meaning that DC/DNS's IP address is not in any machine's NIC, and you remove the server, that you can't resolve any internal resources?
Is your AD domain name 2 levels or more (not including the TLD), such as domain1.domain2.domain3.com? If it is, does the search suffix reflect the multiple levels up to the AD level? 
The reason I ask is due to the way 2008 and newer devolves the domain levels to the forest root. Nslookup will use that.
For example, one guy had the same problem in the following discussion (https://social.technet.microsoft.com/Forums/windowsserver/en-US/cf1c0434-3545-4a50-8774-38416e11c417/windows-server-2008-nslookup-request-time-out).
 His ipconfig /all looks like the following:
 Host Name . . . . . . . . . . . . : server
   Primary Dns Suffix  . . . . . . . : test.co.in
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : test.co.in 
Note that the search list is three level. When he added co.in to it, the problem went away.
Another possibility is to increase the timeout period. One poster noted that in that discussion. The default is 3 seconds. Some have bumped it up much higher using dnscmd:
dnscmd servername /config /recursiontimeout X
Where "X" is in seconds.
I assume you have all the Windows 2008 R2 DNS hotfixes and updates, too. If not, checkout the following. Run them. If you have them, it will tell you.
DNS Server service does not use root hints to resolve external names in Windows Server 2008 R2
Post Windows 2008 R2 SP1 HOTFIX available.
APPLIES TO •Windows 2008 R2 Datacenter •Windows 2008 R2 Ent •Windows 2008 R2 Std.
Requires a restart.
http://support.microsoft.com/kb/2616776
DNS Server service does not resolve some external DNS names after it works for a while in Windows Server 2008 R2
Hotfix release - (released 4/15/2011)
http://support.microsoft.com/kb/2508835
DNS server stops responding to DNS queries from client computers in in Windows Server 2003, in Windows Server 2008 or in Windows Server 2008 R2 - Post Service Pack Hotfix available.
Does not require a restart.
http://support.microsoft.com/kb/2655960
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.