TechnitiumSoftware/DnsServer · error · DnsServerException

Failed to resolve forwarder domain name for all conditional

Error message

Failed to resolve forwarder domain name for all conditional forwarders: {forwarders}

What it means

Thrown by the conditional-forwarder resolution path when, after attempting to resolve the configured conditional forwarders' nameserver domain names, none produced a usable group (conditionalForwarderGroups.Count < 1). lastResolverException carries the underlying cause.

Source

Thrown at DnsServerCore/Dns/DnsServer.cs:5456

                        conditionalForwarderGroups[forwarder.Priority] = conditionalForwardersEntry;
                    }
                }
            }

            if (conditionalForwarderGroups.Count < 1)
            {
                List<NameServerAddress> forwarders = new List<NameServerAddress>(conditionalForwarders.Count);

                foreach (DnsResourceRecord conditionalForwarder in conditionalForwarders)
                {
                    if (conditionalForwarder.Type != DnsResourceRecordType.FWD)
                        continue;

                    forwarders.Add((conditionalForwarder.RDATA as DnsForwarderRecordData).NameServer);
                }

                throw new DnsServerException("Failed to resolve forwarder domain name for all conditional forwarders: " + forwarders.Join(), lastResolverException);
            }

            if (conditionalForwarderGroups.Count == 1)
            {
                foreach (KeyValuePair<byte, List<DnsResourceRecord>> conditionalForwardersEntry in conditionalForwarderGroups)
                    return await ConcurrentConditionalForwarderResolveAsync(question, eDnsClientSubnet, advancedForwardingClientSubnet, dnsCache, conditionalForwardersEntry.Value, skipDnsAppAuthoritativeRequestHandlers);
            }

            List<byte> priorities = new List<byte>(conditionalForwarderGroups.Keys);
            priorities.Sort();

            using (CancellationTokenSource cancellationTokenSource = new CancellationTokenSource())
            {
                CancellationToken currentCancellationToken = cancellationTokenSource.Token;

                DnsDatagram lastResponse = null;
                Exception lastException = null;

View on GitHub (pinned to d0484b6c1e)

Solutions

  1. Use an IP address for the FWD record's nameserver instead of a hostname.
  2. Ensure the NS hostname for the conditional forwarder is resolvable by the server's bootstrap path.
  3. Inspect the inner exception (lastResolverException) and the resolver log to find which forwarder failed and why.
  4. Remove or correct stale conditional forwarder records for zones that no longer exist.

Example fix

// before
fwdRecord.NameServer = new NameServerAddress("ad-dc.corp.internal");

// after
fwdRecord.NameServer = new NameServerAddress("10.0.10.5:53");  // AD DC IP
Defensive patterns

Strategy: fallback

Validate before calling

// Ensure each conditional forwarder NS is resolvable up-front
async Task<bool> CfwdResolvesAsync(IEnumerable<DnsResourceRecord> cfwd)
{
    foreach (var r in cfwd.Where(r => r.Type == DnsResourceRecordType.FWD))
    {
        var ns = (r.RDATA as DnsForwarderRecordData).NameServer;
        if (!ns.IsIPEndPoint && (await System.Net.Dns.GetHostAddressesAsync(ns.Host)).Length == 0) return false;
    }
    return true;
}

Try / catch

try { await server.ResolveAsync(q); }
catch (DnsServerException ex) when (ex.Message.Contains("Failed to resolve forwarder domain name for all conditional forwarders")) { log.Error("Check conditional forwarder NS hostnames or use IPs", ex); }

Prevention

When it happens

Trigger: A zone set up as a conditional forwarder (FWD record) whose nameserver hostname cannot be resolved, for every conditional forwarder in the group; misconfigured FWD records pointing at nonexistent NS hostnames.

Common situations: Conditional forwarder for an internal domain whose NS hostname only resolves inside a VPN the server is not on; migrated internal domain with stale FWD targets; circular dependency between conditional forwarders and the root resolver.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/800fb88a54b09f37. Report an issue: GitHub.