The DNS server encountered an invalid domain name in a packet from 157.56.112.42

Question

_{Tuesday, December 12, 2017 8:05 PM}

I have just seen that I am getting 20 of these messages an hour, always from the same IP address

The DNS server encountered an invalid domain name in a packet from 157.56.112.42. The packet will be rejected. The event data contains the DNS packet.

I am running a small business server with 2008 R2 DC, AD and Exchange Server, we are only a small company so resources are limited, any idea on what is causing the problem or how to go about fixing it, its not an IP address we use.

All replies (1)

_{Wednesday, December 13, 2017 2:56 AM ✅Answered}

Hi ，

Please first check if the event ID 5504 is logged in the event log.

Event ID 5504 is logged when a DNS Server receives a packet containing an invalid domain name. There are many possible causes.

1. The DNS cache becomes corrupt with invalid domain names.

2. The DNS Server receives a spoofed response.

3. The DNS response contains domain names with characters other than 0-9, a-z, A-Z, . (Period), and - (Hyphen).

4. The DNS Server has been configured with invalid forwarders

5. The network the DNS server resides on is busy or not working properly.

For more details, please refer to the following link:

Forum FAQ: How to troubleshoot DNS Event 5504 error

https://social.technet.microsoft.com/Forums/windowsserver/en-US/1ed06e4a-ca31-4594-b8b5-5a9e40811534/forum-faq-how-to-troubleshoot-dns-event-5504-error?forum=winserverNIS

Best Regards,

Candy

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].