Windows 2012 can't validate forwarders without a root zone?

(Disclaimer: I am not a Windows DNS admin. I do have a decent amount of DNS experience under my belt though, and this is not making any sense. I am working closely with the admins responsible for these devices and can get tests performed as needed.)

We have run into an issue where we cannot add conditional forwarders that point to BIND nameservers under Windows Server 2012. Adding the IP address of the server results in a validation error: An unknown error occurred while validating the server.

Looking at the query log on the BIND server, we found something rather interesting: the Windows DNS server was querying for . IN SOA, i.e. the SOA record for the root nameservers. No query for example.com. IN SOA at all. It attempts to query for root authority and doesn't continue when it receives a response of REFUSED.

client 192.168.203.20#59067 (.): query: . IN SOA - (192.168.208.201)
client 192.168.203.20#50553 (.): query: . IN SOA - (192.168.208.201)
client 192.168.203.20#55468 (.): query: . IN SOA - (192.168.208.201)

Madness. To humor it, we reproduced this problem in the lab. I downloaded a copy of the root zone and configured a . zone (commenting out my root hints), and lo and behold, this error no longer occurs.

I really don't get this. I'm providing an authoritative nameserver that shouldn't have to provide answers to . SOA, and as matters stand I'm going to have to add this zone to all of our production servers just to play nicely with Windows 2012. In my experience, a forwarder should only be concerned with whether or not the target nameserver is authoritative for the zone in question.

Why is this happening?

If we try to ignore the error (click on OK anyway), we get the following error dialog:

The query log still shows that the upstream server is only asking for . IN SOA. There is never an attempt to see if the server is authoritative for example.com..

I tried to reproduce this on both Windows 2012 and Windows 2012 R2 but couldn't get the same end result.

I can confirm the initial validation error (An unknown error occurred while validating the server.), and I can see the strange query for . IN SOA, but clicking "OK" at that point appears to work (no further errors are shown and the forwarding zone is added).

It appears that the second error message that you encountered (A problem occurred while trying to add the conditional forwarder. A zone configuration problem occurred.) may be unrelated to the strange validation behavior.

I can't really tell why it is doing its validation based on a query for . IN SOA but it appears to be mostly a cosmetic problem as you're not prevented from proceeding despite the validation failure.