Workspace DNS resolution is wrong

Question

I have a workspace machine (Windows 10) where the DNS resolution is always returning the wildcard domain over the actual entries in the domain.  For example if I have the following DNS entries:

*.somecompany.com        CNAME
    app.somecompany.com      CNAME

Then I do a dns lookup on the workspace machine for `nslookup app.somecompany.com` then it returns the entry for `*.somecompany.com` and not the expected entry for `app.somecompany.com`.  In fact I can test with several other domains registered in my DNS Zone settings, and they all return `*somecompany.com`.  My zone is hosted on Route 53.  If I do a similar resolution outside of the workspace it resolves correctly.  And this used to work flawlessly on workspaces.  What I did notice was that my DNS server on the workspace instance is set to my Simple Directory for my account, but outside of the workspace it's set to VPC's DNS server or an external DNS server.  I don't see a lot of ways to inspect how the DNS is set up on the Simple Directory either.

I should also add if I do a `nslookup google.com` I get the answer for `*.somecompany.com`!  But if I go into Chrome or Firefox and enter `google.com` then it returns the expected results.  But other programs on my machine seem to be suffering from the same issue.

So something about the Simple Directory server running for my domain isn't updating from Route53 or is just not working.  What is going on?

Answer

Hello! According to this link https://docs.aws.amazon.com/directoryservice/latest/admin-guide/simple_ad_dns.html Simple AD does not support dynamic DNS updates. When launching a WorkSpace, the IP's of your Simple AD domain controllers are assigned as static. The previous link offers additional guidance so I recommend taking a look.

EC2 instances work differently in this regard. When launching an EC2 instance and joining to the domain, the DNS IP settings are not set, so the default DHCP option takes place (unless your AD has a group policy that sets them). If you have DHCP Options configured in your VPC https://docs.aws.amazon.com/directoryservice/latest/admin-guide/dhcp_options_set.html the EC2 instance will get its domain name and DNS settings from it.

Answer

This is really weird because as you probably know a wildcard is handled "server side" and would never be exposed to a DNS client. So, assume the following sequence:
```
t0 - only *.example.com A 10.1.1.1 TTL 3600 exists
t1 - you nslookup test1.example.com -> result is 10.1.1.1 and it's cached
t2 - test2.example.com A 10.2.2.2 is added
t3 - you run nslookup test2.example.com -> at this point the only thing the client can do is go to server, it doesn't know at t1 the response would have been the same than for test1
```

The only case what you are describing would happen is:
```
t4 - you nslookup test3.example.com -> 10.1.1.1 (from the wildcard) is returned, with a ttl of 900
t5 - test3.example.com A 10.3.3.3 is added
t6 - you nslookup test3.example.com again -> 10.1.1.1 will be returrned until the record cached at t4 expires, 10.3.3.3 afterwards
```

To rule out any caching issue, have you tried creating a new subdomain you've never queried before (in the same zone with the * record), and see how it resolves?

Workspace DNS resolution is wrong

Relevant content