Why are UDP requests constantly flying from the controller?

Question

Forefront Threat Management Gateway

Users complained about problems with the speed of the Internet.
On TMG in the monitoring I saw this DC controller (not the main one) loads the channel 78%. Access to the Internet was closed to him. I don't know where to dig further.

Answer 1

Port 53 is DNS. You probably have dns up there on the secondary DC, which resolves the domains on its own. Make it first forward requests to the provider's dns.

Answer 2

Yes, the second controller has DNS. From the first controller where the main DNS is, the forward was configured to the second DNS. And on the second DNS in the forward it was empty. How did the inte work all this time xs. The provider itself uses Google's DNS. Added Google dns to both DNS forwards.