This morning my site had our primary DNS go down, we have 3 DNS servers in the DNS settings tab on all our nics, we have 5 subnets associated to our site. Now when our primary DNS went down we here at our main site were still able to resolve both internal and external, however one subnet range was isolated no internal or external. Now from my stance I know that they did not successfully move to the next dns server in the order but I need to prove it... Is there an event id or log I can use to show this?

Another unique aspect is this subnet range gets there DHCP from a cisco ASA device, and the argument is being made that everyone else did not go down the dns server list meaning when the primary failed it went straight to the last server in the list even though the rest of the servers were up and working.

Any insight as to how I can prove this from a windows perspective without stopping the dns server service to duplicate the issue would be appreciated.