The error: Internal hostnames resolve correctly, but external domains (google.com, anything on the public internet) fail to resolve from clients using this DNS server.
Environment: Windows Server acting as internal DNS for an Active Directory domain.
Why this happens: An AD DNS server only knows about your internal zone natively — anything external has to be handed off to a forwarder (typically your ISP's DNS or a public resolver like 8.8.8.8). If the forwarder configuration is missing, wrong, or the forwarder itself is unreachable (a firewall rule change, an ISP outage), internal resolution keeps working perfectly while external resolution just stops, which reads as confusing because "DNS is clearly working" for half of what people test.
The fix:
- Check configured forwarders: DNS Manager → right-click the server → Properties → Forwarders tab.
- Test the forwarder is actually reachable from the DNS server itself:
Test-NetConnection 8.8.8.8 -Port 53. - Check root hints as a fallback path if forwarders are correctly configured but still failing — sometimes root hints are stale.
- Check the server's own outbound firewall rules for UDP/TCP 53 if the forwarder test fails despite correct configuration.
One thing worth knowing: this exact symptom — internal fine, external broken — is one of the fastest things to diagnose precisely because it narrows the problem to one specific hop (the forwarder) immediately. Don't start troubleshooting client-side DNS settings; the server-side forwarder is almost always it.