8

Pretty vanilla, just installed Win 7, SP1, 64-bit. No IPv6 access. The network status says IPv4: Internet. IPv6: No network access.

Pick a domain that has DNS servers that have both IPv4 and IPv6 addresses, for example www.hummerzines.com.au (dave.ns.cloudflare.com).

Do an nslookup from the command line:

C:\Users\Dom\Desktop>nslookup hummerzines.com.au dave.ns.cloudflare.com
Server:  dave.ns.cloudflare.com
Address:  173.245.59.109

Name:    hummerzines.com.au
Addresses:  141.101.116.193
          141.101.117.193

Now do an nslookup from inside nslookup:

C:\Users\Dom\Desktop>nslookup
Default Server:  resolv.internode.on.net
Address:  192.231.203.132

> hummerzines.com.au dave.ns.cloudflare.com
Server:  dave.ns.cloudflare.com
Addresses:  2400:cb00:2049:1::adf5:3b6d
          173.245.59.109

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to dave.ns.cloudflare.com timed-out

Why is Windows performing differently in these two circumstances? I assume it's timing out because it's trying to do the DNS lookup via IPv6? I haven't run WireShark yet to prove/deny this.

Output of ipconfig /all:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : xxx
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC (NDIS 6.20) #2
   Physical Address. . . . . . . . . : 00-24-1D-C9-D0-7E
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC (NDIS 6.20)
   Physical Address. . . . . . . . . : 00-24-1D-C9-D0-8E
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::200a:e243:364f:8ec9%11(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.11.10(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Thursday, 20 February 2014 8:36:49 AM
   Lease Expires . . . . . . . . . . : Monday, 24 February 2014 8:36:48 AM
   Default Gateway . . . . . . . . . : 192.168.11.1
   DHCP Server . . . . . . . . . . . : 192.168.11.1
   DHCPv6 IAID . . . . . . . . . . . : 234890269
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1A-66-F2-E1-00-24-1D-C9-D0-8E

   DNS Servers . . . . . . . . . . . : 192.231.203.132
                                       192.231.203.3
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{0693AA71-5382-4DED-8260-EA710149F8A9}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 12:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:90d7:c0a:2ff5:c458:7ffb(Preferred)
   Link-local IPv6 Address . . . . . : fe80::c0a:2ff5:c458:7ffb%14(Preferred)
   Default Gateway . . . . . . . . . : ::
   NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter isatap.{870AA1C0-1FDE-4852-87D6-34357F1C7177}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
6
  • Just because you don't have a ipv6 address does not mean you can't connect or resolve ipv6 addresses
    – Ramhound
    Feb 22, 2014 at 4:20
  • I need to know why these names are not resolving.... If that's got nothing to do with not having IPv6 access I need to know why it is happening. It happens on Windows Servers I run as well (SBS 2008, Server 2008 R2 and more) and I need to fix it.
    – Dom
    Feb 22, 2014 at 12:11
  • Post the output of ipconfig /all. Feb 22, 2014 at 18:36
  • It's probably a bug in nslookup. What's there to worry about? If you want the error to go away, uncheck IPv6 on your network connection(s). Just to clarify: nslookup queries DNS servers. It does not use Windows' DNS resolver.
    – Daniel B
    Feb 22, 2014 at 23:50
  • Unchecking IPv6 doesn't improve matters. I'm worried because SBS 2008 and Server 2008 and Server 2008 R2 sometimes cannot resolve records on CloudFlare and it has something to do with this strange problem. No linux servers have issues. Sometimes windows servers can resolve some records on CloudFlare and not others, on the same domain. I need to work out why.
    – Dom
    Feb 23, 2014 at 6:12

3 Answers 3

6

Your computer has tried to create a Teredo connection. Teredo is one of several IPv6 transition technologies, all of which have various drawbacks. Teredo's is that it just doesn't work in a variety of scenarios for which it was explicitly designed, such as being behind an IPv4 NAT device.

Thus, since Teredo is enabled, your computer thinks it has IPv6 connectivity, when that connectivity is actually broken. (The network status icon uses a completely different check for connectivity that is more accurate.)

To resolve the issue, disable Teredo (and while you're at it, the other two problematic ones, 6to4 and ISATAP). Right-click on Command Prompt and click Run as Administrator, then run the following:

netsh int ipv6 isatap set state disabled
netsh int ipv6 6to4 set state disabled
netsh int teredo set state disabled

Then restart your computer.

2
  • I'm having similar problems to OP. Is the netsh approach you are suggesting similar to editing the registry @ HKLM:\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters DisabledComponents ? And if not, is your approach the "recommended one" ? Jul 2, 2014 at 11:50
  • @FélixCantournet Yes, it's about the same thing. But it's always recommended to avoid the registry unless you know exactly what you're doing, because it's very easy to make a mistake and change more than you intended. Jul 2, 2014 at 11:57
2

Windows is not handling this differently per se, but rather nslookup is broken on Windows.

Resolvers always return both IPv4 addresses and IPv6 addresses if they are available and an address type is not specified. All default configurations on modern network stacks have a preference for IPv6 addresses over IPv4 addresses. This means that the IPv6 addresses are always returned before IPv4 addresses. This normally is not an issue since the client applications usually loop through the addresses returned by the resolver if the first address fails. In the case of IPv6 vs IPv4 addresses, the failure of IPv6 is nearly instant if a default IPv6 route is not configured.

The DNS server is dual stacked, meaning that it has both IPv4 and IPv6 addresses. When performing the lookup by specifying the default DNS server as a command line option, nslookup properly loops through the IP addresses starting with IPv6 and ending on IPv4. However when using nslookup interactively, nslookup only tries the first address which is returned by the resolver, which will always be the IPv6 address.

The fix for this is to specify the DNS servers by IP address when using nslookup interactively or use nslookup non-interactively by specifying the default DNS server on the command line.

Note this only affects nslookup on Windows, modern versions of Linux and OS X use a fixed version of nslookup.

0

I had a similar problem and found the solution. Make sure Windows does not have cached any IPv4 and IPv6 DNS resolvers.

DNSCrypt: How to prevent Windows from resolving blacklisted names?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .