I have 2 Windows Server 2008 R2 DNS Servers which share the domain xyz.wan and reside in the 192.168.50.0/24 subnet of my network. Connected via IPSec VPN site-to-site are some other subnets (192.168.51.0/24, .52.0/24, etc.) which have their own reverse-lookup zones in Microsoft DNS.
Recently my servers began behaving strangely by resolving ALL addresses NOT in DNS (e.g. some static client on a remote site with no DNS record) to the own name, server1.xyz.wan, instead of showing the IP in Windows-perfmon.
Now I found out, that if I do a nslookup on either one of the 2 servers and enter some IP I don't even use, like 192.168.111.111, the other server responds with "localhost".
The DNS resolving works like a charm for everything in the domain. I also traced the packets with Wireshark:
192.168.50.161 192.168.50.163 DNS 88 Standard query PTR 111.111.168.192.in-addr.arpa
192.168.50.163 192.168.50.161 DNS 111 Standard query response PTR localhost
Can someone point me in the right direction of what is going on here? I just can't figure it out.