The DNS server encountered an invalid domain name

Hi,

We have a sinlge forest/domain. 2 dcs at data centre. DNS in AD-integrated
and all dcs are gcs. The primary dc dns is configured to provide the dns
service for internet users through the firewall (allowing protocol-
udp/domain). Everything is working fine. No other errors. But we keep getting
the below information events in the DNS event logs.

Event Type: Information
Event Source: DNS
Event Category: None
Event ID: 5504
Date: 5/15/2008
Time: 8:05:54 AM
User: N/A
Computer: HODC1
Description:
The DNS server encountered an invalid domain name in a packet from
63.209.3.132. The packet will be rejected. The event data contains the DNS
packet.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7d b5 84 00 01 00 06 00 }µ?.....
0008: 00 00 00 00 06 74 6f 67 .....tog
0010: 67 6c 65 03 77 77 77 02 gle.www.
0018: 6d 73 06 61 6b 61 64 6e ms.akadn
0020: 73 03 6e 65 74 00 00 1c s.net...
0028: 00 01 c0 0c 00 05 00 01 ..ہ.....
0030: 00 00 01 2c 00 04 01 67 ...,...g
0038: c0 13 c0 36 00 05 00 01 ہ.ہ6....
0040: 00 00 01 2c 00 06 03 6c ...,...l
0048: 62 31 c0 13 c0 46 00 01 b1ہ.ہF..
0050: 00 01 00 00 01 2c 00 04 .....,..
0058: cf 2e 13 fe c0 46 00 01 د..‏ہF..
0060: 00 01 00 00 01 2c 00 04 .....,..
0068: cf 2e c0 fe c0 46 00 01 د.ہ‏ہF..
0070: 00 01 00 00 01 2c 00 04 .....,..
0078: cf 2e 13 be c0 46 00 01 د..¾ہF..
##################################################

Event Type: Information
Event Source: DNS
Event Category: None
Event ID: 5504
Date: 5/14/2008
Time: 3:57:59 PM
User: N/A
Computer: HODC1
Description:
The DNS server encountered an invalid domain name in a packet from
208.44.108.137. The packet will be rejected. The event data contains the DNS
packet.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: d7 7b 84 00 01 00 02 00 ×{?.....
0008: 00 00 00 00 0c 6c 6f 67 .....log
0010: 69 6e 2d 67 6c 6f 62 61 in-globa
0018: 6c 06 79 61 68 6f 6f 38 l.yahoo8
0020: 06 61 6b 61 64 6e 73 03 .akadns.
0028: 6e 65 74 00 00 1c 00 01 net.....
0030: c0 0c 00 05 00 01 00 00 ہ.......
0038: 01 2c 00 0e 05 6c 6f 67 .,...log
0040: 69 6e 05 79 61 68 6f 6f in.yahoo
0048: c0 20 c0 3c 00 01 00 01 ہ ہ<....
0050: 00 00 00 3c 00 04 45 93 ...<..E?
0058: 70 a0 p

#############################


Please guide, what are these event logs ?

Thanks in advance,

abc.

Hi
Have a look at this link
http://www.eventid.net/display.asp?e...ce=DNS&phase=1

--
I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MCSE, MVP Directory Services

Hi,

Thanks for reply.

I did check that link before. I have not configured our dns server as
forwarder. As said i have allowed udp/domain in the firewall to resolve
internet dns queries by the server through root hints.

I will have a look at firewall. But there were no such errors earlier, when
we had a seperate dns server, with similar firewall settings.

Thanks again,

abc

"Jorge Silva" wrote:

> Hi
> Have a look at this link
> http://www.eventid.net/display.asp?e...ce=DNS&phase=1
>
> --
> I hope that the information above helps you.
> Have a Nice day.
>
> Jorge Silva
> MCSE, MVP Directory Services
>
>

I don't know anything about this error, but maybe this link will help.
http://www.eventid.net/display.asp?e...ce=DNS&phase=1

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

"abckid" <abckid@discussions.microsoft.com> wrote in message
news:9D48B044-761A-4B84-B1F7-6AB4699897C9@microsoft.com...
> Hi,
>
> We have a sinlge forest/domain. 2 dcs at data centre. DNS in AD-integrated
> and all dcs are gcs. The primary dc dns is configured to provide the dns
> service for internet users through the firewall (allowing protocol-
> udp/domain). Everything is working fine. No other errors. But we keep
> getting
> the below information events in the DNS event logs.
>
> Event Type: Information
> Event Source: DNS
> Event Category: None
> Event ID: 5504
> Date: 5/15/2008
> Time: 8:05:54 AM
> User: N/A
> Computer: HODC1
> Description:
> The DNS server encountered an invalid domain name in a packet from
> 63.209.3.132. The packet will be rejected. The event data contains the DNS
> packet.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 7d b5 84 00 01 00 06 00 }µ?.....
> 0008: 00 00 00 00 06 74 6f 67 .....tog
> 0010: 67 6c 65 03 77 77 77 02 gle.www.
> 0018: 6d 73 06 61 6b 61 64 6e ms.akadn
> 0020: 73 03 6e 65 74 00 00 1c s.net...
> 0028: 00 01 c0 0c 00 05 00 01 ..?.....
> 0030: 00 00 01 2c 00 04 01 67 ...,...g
> 0038: c0 13 c0 36 00 05 00 01 ?.?6....
> 0040: 00 00 01 2c 00 06 03 6c ...,...l
> 0048: 62 31 c0 13 c0 46 00 01 b1?.?F..
> 0050: 00 01 00 00 01 2c 00 04 .....,..
> 0058: cf 2e 13 fe c0 46 00 01 ?..??F..
> 0060: 00 01 00 00 01 2c 00 04 .....,..
> 0068: cf 2e c0 fe c0 46 00 01 ?.???F..
> 0070: 00 01 00 00 01 2c 00 04 .....,..
> 0078: cf 2e 13 be c0 46 00 01 ?..¾?F..
> ##################################################
>
> Event Type: Information
> Event Source: DNS
> Event Category: None
> Event ID: 5504
> Date: 5/14/2008
> Time: 3:57:59 PM
> User: N/A
> Computer: HODC1
> Description:
> The DNS server encountered an invalid domain name in a packet from
> 208.44.108.137. The packet will be rejected. The event data contains the
> DNS
> packet.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: d7 7b 84 00 01 00 02 00 ×{?.....
> 0008: 00 00 00 00 0c 6c 6f 67 .....log
> 0010: 69 6e 2d 67 6c 6f 62 61 in-globa
> 0018: 6c 06 79 61 68 6f 6f 38 l.yahoo8
> 0020: 06 61 6b 61 64 6e 73 03 .akadns.
> 0028: 6e 65 74 00 00 1c 00 01 net.....
> 0030: c0 0c 00 05 00 01 00 00 ?.......
> 0038: 01 2c 00 0e 05 6c 6f 67 .,...log
> 0040: 69 6e 05 79 61 68 6f 6f in.yahoo
> 0048: c0 20 c0 3c 00 01 00 01 ? ?<....
> 0050: 00 00 00 3c 00 04 45 93 ...<..E?
> 0058: 70 a0 p
>
> #############################
>
>
> Please guide, what are these event logs ?
>
> Thanks in advance,
>
> abc.

Sorry, didn't see Jorge's response. Please disregard.

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

"Paul Bergson [MVP-DS]" <pbergson@allete_nospam.com> wrote in message
news:Oiq3dwotIHA.4876@TK2MSFTNGP02.phx.gbl...
>I don't know anything about this error, but maybe this link will help.
> http://www.eventid.net/display.asp?e...ce=DNS&phase=1
>
> --
> Paul Bergson
> MVP - Directory Services
> MCTS, MCT, MCSE, MCSA, Security+, BS CSci
> 2008, 2003, 2000 (Early Achiever), NT4
>
> http://www.pbbergs.com
>
> Please no e-mails, any questions should be posted in the NewsGroup
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
> "abckid" <abckid@discussions.microsoft.com> wrote in message
> news:9D48B044-761A-4B84-B1F7-6AB4699897C9@microsoft.com...
>> Hi,
>>
>> We have a sinlge forest/domain. 2 dcs at data centre. DNS in
>> AD-integrated
>> and all dcs are gcs. The primary dc dns is configured to provide the dns
>> service for internet users through the firewall (allowing protocol-
>> udp/domain). Everything is working fine. No other errors. But we keep
>> getting
>> the below information events in the DNS event logs.
>>
>> Event Type: Information
>> Event Source: DNS
>> Event Category: None
>> Event ID: 5504
>> Date: 5/15/2008
>> Time: 8:05:54 AM
>> User: N/A
>> Computer: HODC1
>> Description:
>> The DNS server encountered an invalid domain name in a packet from
>> 63.209.3.132. The packet will be rejected. The event data contains the
>> DNS
>> packet.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>> Data:
>> 0000: 7d b5 84 00 01 00 06 00 }µ?.....
>> 0008: 00 00 00 00 06 74 6f 67 .....tog
>> 0010: 67 6c 65 03 77 77 77 02 gle.www.
>> 0018: 6d 73 06 61 6b 61 64 6e ms.akadn
>> 0020: 73 03 6e 65 74 00 00 1c s.net...
>> 0028: 00 01 c0 0c 00 05 00 01 ..?.....
>> 0030: 00 00 01 2c 00 04 01 67 ...,...g
>> 0038: c0 13 c0 36 00 05 00 01 ?.?6....
>> 0040: 00 00 01 2c 00 06 03 6c ...,...l
>> 0048: 62 31 c0 13 c0 46 00 01 b1?.?F..
>> 0050: 00 01 00 00 01 2c 00 04 .....,..
>> 0058: cf 2e 13 fe c0 46 00 01 ?..??F..
>> 0060: 00 01 00 00 01 2c 00 04 .....,..
>> 0068: cf 2e c0 fe c0 46 00 01 ?.???F..
>> 0070: 00 01 00 00 01 2c 00 04 .....,..
>> 0078: cf 2e 13 be c0 46 00 01 ?..¾?F..
>> ##################################################
>>
>> Event Type: Information
>> Event Source: DNS
>> Event Category: None
>> Event ID: 5504
>> Date: 5/14/2008
>> Time: 3:57:59 PM
>> User: N/A
>> Computer: HODC1
>> Description:
>> The DNS server encountered an invalid domain name in a packet from
>> 208.44.108.137. The packet will be rejected. The event data contains the
>> DNS
>> packet.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>> Data:
>> 0000: d7 7b 84 00 01 00 02 00 ×{?.....
>> 0008: 00 00 00 00 0c 6c 6f 67 .....log
>> 0010: 69 6e 2d 67 6c 6f 62 61 in-globa
>> 0018: 6c 06 79 61 68 6f 6f 38 l.yahoo8
>> 0020: 06 61 6b 61 64 6e 73 03 .akadns.
>> 0028: 6e 65 74 00 00 1c 00 01 net.....
>> 0030: c0 0c 00 05 00 01 00 00 ?.......
>> 0038: 01 2c 00 0e 05 6c 6f 67 .,...log
>> 0040: 69 6e 05 79 61 68 6f 6f in.yahoo
>> 0048: c0 20 c0 3c 00 01 00 01 ? ?<....
>> 0050: 00 00 00 3c 00 04 45 93 ...<..E?
>> 0058: 70 a0 p
>>
>> #############################
>>
>>
>> Please guide, what are these event logs ?
>>
>> Thanks in advance,
>>
>> abc.
>
>

Hello abckid,

Check out this ones:
http://www.chicagotech.net/troublesh...ventid5504.htm

http://support.microsoft.com/kb/920162

http://support.microsoft.com/?kbid=316786

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Hi,
>
> We have a sinlge forest/domain. 2 dcs at data centre. DNS in
> AD-integrated and all dcs are gcs. The primary dc dns is configured to
> provide the dns service for internet users through the firewall
> (allowing protocol- udp/domain). Everything is working fine. No other
> errors. But we keep getting the below information events in the DNS
> event logs.
>
> Event Type: Information
> Event Source: DNS
> Event Category: None
> Event ID: 5504
> Date: 5/15/2008
> Time: 8:05:54 AM
> User: N/A
> Computer: HODC1
> Description:
> The DNS server encountered an invalid domain name in a packet from
> 63.209.3.132. The packet will be rejected. The event data contains the
> DNS
> packet.
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 7d b5 84 00 01 00 06 00 }µ?.....
> 0008: 00 00 00 00 06 74 6f 67 .....tog
> 0010: 67 6c 65 03 77 77 77 02 gle.www.
> 0018: 6d 73 06 61 6b 61 64 6e ms.akadn
> 0020: 73 03 6e 65 74 00 00 1c s.net...
> 0028: 00 01 c0 0c 00 05 00 01 ..?.....
> 0030: 00 00 01 2c 00 04 01 67 ...,...g
> 0038: c0 13 c0 36 00 05 00 01 ?.?6....
> 0040: 00 00 01 2c 00 06 03 6c ...,...l
> 0048: 62 31 c0 13 c0 46 00 01 b1?.?F..
> 0050: 00 01 00 00 01 2c 00 04 .....,..
> 0058: cf 2e 13 fe c0 46 00 01 ?..??F..
> 0060: 00 01 00 00 01 2c 00 04 .....,..
> 0068: cf 2e c0 fe c0 46 00 01 ?.???F..
> 0070: 00 01 00 00 01 2c 00 04 .....,..
> 0078: cf 2e 13 be c0 46 00 01 ?..¾?F..
> ##################################################
> Event Type: Information
> Event Source: DNS
> Event Category: None
> Event ID: 5504
> Date: 5/14/2008
> Time: 3:57:59 PM
> User: N/A
> Computer: HODC1
> Description:
> The DNS server encountered an invalid domain name in a packet from
> 208.44.108.137. The packet will be rejected. The event data contains
> the DNS
> packet.
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: d7 7b 84 00 01 00 02 00 ×{?.....
> 0008: 00 00 00 00 0c 6c 6f 67 .....log
> 0010: 69 6e 2d 67 6c 6f 62 61 in-globa
> 0018: 6c 06 79 61 68 6f 6f 38 l.yahoo8
> 0020: 06 61 6b 61 64 6e 73 03 .akadns.
> 0028: 6e 65 74 00 00 1c 00 01 net.....
> 0030: c0 0c 00 05 00 01 00 00 ?.......
> 0038: 01 2c 00 0e 05 6c 6f 67 .,...log
> 0040: 69 6e 05 79 61 68 6f 6f in.yahoo
> 0048: c0 20 c0 3c 00 01 00 01 ? ?<....
> 0050: 00 00 00 3c 00 04 45 93 ...<..E?
> 0058: 70 a0 p
> #############################
>
> Please guide, what are these event logs ?
>
> Thanks in advance,
>
> abc.
>