Dire DNS Difficulty

[SpeedBird]

I have a private network with three Windows 2003 Server machines with DNS installed. Basically, I have a list of website addresses that are allowed, but I want to block everything else. I cannot do this with the modem/router (I can only block certain websites with the modem). So I decided, instead, to do it with DNS.

The current (allow all) configuration is like this:

1. Windows DNS server - 192.168.1.250

2. Windows DNS server - 192.168.1.251

The above servers are configured for zone transfers. They forward all non-internal queries to the modem.

3. Modem - 192.168.1.254

4. Several client machines (DHCP'd via the modem). The client machines use 192.168.1.250 and 192.168.1.251 as their manually configured DNS servers.

Here's what I'm trying:

1. Windows DNS server - 192.168.1.250

2. Windows DNS Server - 192.168.1.251

The above servers are now configured to forward allowed domains to the modem (192.168.1.254), and all other domains to 192.168.1.252.

3. Windows DNS/IIS Server - 192.168.1.252. This is a standalone DNS server with only a single forward lookup zone holding an A record for zone *. This zone has an A record pointing to 192.168.1.252 as this server also has a website configured in IIS (under Default Site).

4. Modem - 192.168.1.254

5. Several client machines (configured as above).

The problem is 192.168.1.252 still resolves queries forwarded to it to actual external IP addresses. I have tried removing all root hints from all servers to no avail. Using Sam Spade I have confirmed that 192.168.1.252 is correctly resolving external website requests to their real IP address (instead of 192.168.1.252). Also, if I dig * with Sam Spade using 192.168.1.252, it answers authoritatively (I'm guessing wildcarding doesn't work in Windows DNS). I have also unchecked 'protect cache against pollution' on all DNS servers just in case this looked like poisoning to Windows DNS. Still no change.

So, the question is, how can I configure Windows DNS with a single A record for ALL incoming requests?

[SpeedBird]

Never mind, I found the answer. If I create a forward lookup zone on 192.168.1.252 called '.' (full stop) the server thinks it is a root server, and assumes it is authoritative for all zones forwarded to it.