I have two Windows Server 2008 R2 domain controllers which are also DNS servers. Occasionally, like maybe once every few months, random external sites fail DNS lookup. Today that was www.microsoft.com. Lookups succeed in other environments. We have another environment with Windows Server 2003 R2 domain controllers and DNS servers -- no issues there. Flushing cache on DNS servers and local boxes does not help. The only thing that helps is if I remove A.ROOT-SERVERS.NET from the root hints. If I add A.ROOT-SERVERS.NET back, it fails again. If I wait a few days and add it back, it works. So it's intermittent, related somehow to A.ROOT-SERVERS.NET, and only in our one environment on both domain controllers/DNS servers.
I am thoroughly confused.