xbox consoles are sending SRV requests for LDAP servers twice a minute

Hello There. I have been trying to get this question answered by various sources and haven't had any luck.

So reviewing my local DNS logs I have found that both my XBOX consoles the XBOX Series X and XBOX One X. Will each send 2 DNS requests twice a minute for the following SRV record.

_ldap._tcp.dc._msdcs.xxxxxx.xxx

Where xxxxx.xxx is the local domain that my DHCP server sends out for all DHCP requests.

Since there is no LDAP / Active Directory server on my local network for this SRV record my DNS server responds with an NXDOMAIN. Which based on the RFC is expected response.

Reviewing the following document I found on Microsoft's site. https://learn.microsoft.com/en-us/o.../ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04

To locate domain controller (DC) hosting NC N, the client machine issues a DNS query for the SRV record _ldap._tcp.dc._msdcs.N, constructed from the NC name (N).

Okay that's fine but I am just trying to understand why the XBOX consoles need to perform this lookup so often. Also would be nice to understand why is the XBOX looking for an active directory server on a personal home network?

I haven't been able to find anything in the consoles to suggest they are doing some LDAP auth for some local service. But would be interested to know if this is the case.

I have reached out to XBOX Support. The community support suggest I go change the DNS servers on the XBOX System settings. I do this for Cloudflare, GoogleDNS, Quad9 and well I still see the local DNS request to the DHCP server for this LDAP SRV record.

I reply to them that changing the DNS server will not solve the issue since it's a local lookup.

Was just trying to understand why this is happening. So any feedback would be very much appreciated.

This happens on both my XBOX Series X and XBOX One X.

Both devices are in the Alpha Ring. Last check of this morning the XBOX One X was running 10.0.22621.3350 but this appears to have been happening with these DNS lookups for at least a year now from what I can tell based on DNS server logs.

submitted by /u/TJThePhantom
[link] [comments]