When a client sends a DNS query that has an optional EDNS0 section it immediately responds with an FORMERR (Format Error).
I have search and the only things I could find talk about the potential for firewalls to drop the DNS queries that are too large, but that is not happening since I see the query reaching the DNS server, both with DNS debug logging turned on and wireshark
traces.
Successful attempt to the Windows 2008 DNS server in a VM:
; <<>> DiG 9.9.3 <<>> www.google.com @172.19.10.63
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8478
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;www.google.com.
IN
A
;; ANSWER SECTION:
www.google.com.
204
IN
A
216.58.193.100
;; Query time: 25 msec
;; SERVER: 172.19.10.63#53(172.19.10.63)
;; WHEN: Thu Dec 01 18:27:42 MST 2016
;; MSG SIZE rcvd: 59
Unsuccessful attempt to the Windows 2008 DNS server in a VM:
; <<>> DiG 9.9.3 <<>> www.google.com @172.19.10.63 +client=127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status:
FORMERR, id: 5218
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 4096; CLIENT-SUBNET: 127.0.0.1/32/0
;; QUESTION SECTION:
;www.google.com.
IN
A
;; Query time: 0 msec
;; SERVER: 172.19.10.63#53(172.19.10.63)
;; WHEN: Thu Dec 01 18:27:40 MST 2016
;; MSG SIZE rcvd: 55
Successful attempt to a Google DNS server:
; <<>> DiG 9.9.3 <<>> www.google.com @8.8.8.8 +client=127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status:
NOERROR, id: 14658
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 512; CLIENT-SUBNET: 127.0.0.1/32/0
;; QUESTION SECTION:
;www.google.com.
IN
A
;; ANSWER SECTION:
www.google.com.
12
IN
A
216.58.193.100
;; Query time: 14 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Dec 01 18:30:55 MST 2016
;; MSG SIZE rcvd: 71
Any suggestions are appreciated. I have already tried 'dnscmd /config /enableednsprobes 0' and that did not work.