Snortname resolution follows a couple of different paths, both DNS and NetBIOS. Since purging the NBT cache isn't working for you, it must be getting it from somewhere else like WINS. When attempting to resolve a shortname by DNS, it will try resolving each of the domains listed in the DNS search list in order until it finds it. If it finds the wrong one first, it will return that.
If you have a split DNS where servers have both an AD name and a static DNS name, such as, servname.addom.example.com
and servname.servers.example.com
, and have the servers.example.com
domain listed in your search list before addom.example.com
, then it will be the servers.example.com version of that name that will be returned. It is for this reason that I recommend to our own people to ensure that AD's DNS domain tops all such search lists.