It's always DNS

OK, so we had these problems for a while, now and I'm really stuck.

Randomly we will get "can not reach the webpage /server not found.", and it will work if I refresh the page 3-5 times.

Network i fairly simple-design, clients ask AD-servers. AD-servers ask, another internal DNS, and then out on the internet.

client --- AD_DNS --- Internal_DNS --- ISP/google-DNS.

What have I tried (and didn't work):

*Change DNS on Internal_DNS to google/1.1.1.1^*

*Change AD_DNS to google/1.1.1.1/isp^*

*Change client_dns to google/1.1.1.1/isp^*

*Setup a new BIND-dns-sever for Internal DNS.

*Tunnel all web-trafick over ssh from browser(FF)

​

What did work was:

*VPN on client out of the house. (To check if it was the lines)

What parly works:

*Setup a new internal_DNS with Unbound server, this works better than before, but not perfect.

​

If I ping, mtr, traceroute everything works.

​

I have been working on this for so long, that I suspect I'm missing som obvious point or something.

Any steps I can do to verify or exclude possible error-sources?

Please ask all the basic questions, because I have no formal network training.

But I thought (uptil now) that I had a good understanding for basic network.

^s Means I tried 1.1.1.1, 8.8.8.8 and ISP's DNS.

The BIND logs will have a lot of "query failed (SERVFAIL) for xxxxx"

And I ofcouse tested this on mulitple browsers (incl. curl) on multiple computers in and outside the domain.