I am experiencing random failures with my dns server whenever dnssec validation is turned on.
Sometimes the server just fails to get the response from the forwarder. This happened on 2012. Unfortunately it still happens on 2012R2 using a clean install. If I disable dnssec all is well.
Suspecting network problems, I installed a bind9 server on one of my servers, and changed the dc to use this as forwarder. Again with dnssec set to off, all is well, with dnssec validation on, queries start to fail right left and center. Even with firewalls off at both boxes, the 2012 dns server does not seem to successfully do dnssec validation against the bind server on the same subnet. No firewalls between them at all.
It seems dnssec validation in Windows server is broken somehow. Does anyone have this working without random failures ?
One a record that seems to always fail is twit.TV.