Reverse DNS query doesn't work on Meraki

[Cyrus777]

Hello friends.

We are having a weird issue in our organization and have not found a solution for it yet. 

I have DNS server on-prem and on Azure. If a client within the same subnet that DNS servers reside on send a request for reverse, it will work perfectly but all other clients on different subnets or from different routed network on SDWAN Meraki Auto VPN won't be able to get a respond for reverse dns. The forward records are resolved with no issues. We have rebuilt the reverse Zone on DNS and have done a lot of investigation with Meraki support as well but had no chance to find the root cause. we have no rules on MX to kill this traffic but when I did packet capture on a client and dns server I noticed the forward dns queries has a complete communication but the reverse query get lost on Sever end.

Any recommendation will be appreciated. 

[RWelch]

Are the clients on different subnets using the same DNS server for resolution?  Or are their DNS settings pointed to different DNS servers?  Hard to understand from your post if all clients are using the same or different DNS servers?

[Cyrus777]

yes, all clients are using the same set of servers for DNS. 

I have a few DNS servers on-prem and on Azure for HA and all clients are using those servers across the org. Also database for all those DNS servers are synced and they all has the same setup.

[Inderdeep]

try this one case study 

https://community.meraki.com/t5/Wireless/Weird-DNS-Issues/td-p/5352

[Cyrus777]

this does not apply to our case.

Thanks

[OCTOMG]

Do you happen to have Umbrella Protection enabled in your MX Threat Protection settings?  

We experienced a similar problem a couple of years ago and ultimately figured out that we needed to add our internal reverse lookup zones to the exclusion list to keep reverse queries from being routed to Umbrella.

[Cyrus777]

I have already added my domain to excluded from being routed to Cisco Umbrella section in threat protection.

Thanks for the comment 

[OCTOMG]

You added your reverse lookup zones for your internal IP subnets also (i.e. 168.192.in-addr.arpa)?  Just wanted to make sure.

[PhilipDAth]

Does changing the Traffic Analytics settings (under Network-Wide/General) make any difference to the issue?

[Cyrus777]

what else can be done?

[Cyrus777]

I made changes like disabling/ adding my domain/ adding IP range for my LAN.

none of them helped.