
DNS Timeout Only on One VLAN: dig +trace When the Forwarder Is the Fault
- 3 days ago
- 2 min read

Users on VLAN 40 cannot resolve names. VLAN 10 is fine. The AD DNS servers are up.
This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.
What you will be able to do
Name the first CLI command to run on SOC / packet analysis for this ticket
Separate the layer that is actually broken from the layer people blame
Apply one scoped fix instead of a global disable
Prove the ticket closed with a session, log, or counter
Quick answer
dig from a VLAN 40 host. If it times out to the forwarder but works when pointed at 8.8.8.8, the path to the corporate DNS is filtered or the helper is wrong.
Why this ticket shows up
DHCP often hands out a DNS IP that is not reachable from the new VLAN. The servers being 'up' is not the same as reachable.
Symptoms operators actually see
dig @AD times out
dig @8.8.8.8 works
New VLAN
ip helper missing or wrong
CLI first — copy this block
Run these on the SOC / packet analysis device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.
dig @10.0.0.10 www.microsoft.com +time=2
dig @8.8.8.8 www.microsoft.com
dig +trace www.microsoft.com
ipconfig /all
show ip route 10.0.0.10How to read that output
Timeout to AD plus success to public DNS is a reachability or ACL problem on UDP/TCP 53, not a broken AD zone.
Triage order
dig at the configured DNS
Compare with a public resolver
Trace routing/ACL to the AD DNS
Fix helper or ACL
Do not set 8.8.8.8 as the corporate default
Classic traps
What you see | Real cause | Fix |
Change AD zones | Packet never arrived | Fix path |
Give users 8.8.8.8 | You break internal names | Fix reachability |
Rebuild the DC | Other VLANs work | It is this VLAN |
Proof the ticket is closed
dig @AD works on VLAN 40
Internal FQDNs resolve
No public DNS on DHCP
Say this in an interview
DNS 'down' on one VLAN is path to the resolver. I prove it with two digs.
Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments