Re: DNS registration for PDC only correct on some DNS servers?

You are right that you should not normally be naming outside name servers in your inside domain zone's NS set -- unless these
servers answer directly for the zone. These servers are (I will assume) not authoritative for the zone, so you have to take those NS
RRs out of the zone to achieve a correct DNS configuration.

Now if the purpose of that was to permit secondary zone transfers to those servers, you can configure those specific server IPs in
the primary zone's properties dialog - you don't have to implicitly name allowed transfer servers via NS records. OTOH if these
really ARE functioning secondaries for the zone then naming them with NS records should be fine. But in that case an nslookup should
show you all of the AD registrations on the secondary replica and you wouldn't be getting the netstat error you are seeing. I
suppose this all means I need to know a little more about the situation.

nslookup has its own independent lookup logic (that is what makes it useful for debugging dns problems). So it does not show your
configured forwarders. But that is easy enough to check in the properties dialog for the DNS root in the mmc console. In most cases
you can just disable forwarders completely and use the supplied root hints to resolve public names.

Best wishes

Steve Duff, MCSE, MVP
Ergodic Systems, Inc.

"Kim Noer" <kn@xxxxxxxxx> wrote in message news:%23797Fz%23eFHA.3836@xxxxxxxxxxxxxxxxxxxxxxx
> "Steve Duff [MVP]" <ergodic@xxxxxxxxxxxxxxxxxxx> wrote in message
> news:O8U0h90eFHA.1612@xxxxxxxxxxxxxxxxxxxx
>
>> If you want to query external name servers for public names, you
>> normally name their IP addresses as forwarders in the DNS server's
>> properties dialog.
>
> I've already configured that, but I also (let's say accidently) configured the external NS in the forward lookup zone. Presumeably
> that's why my DNS tries to update the external NS (combined with that I don't currently restrict the zone transfer in any way)?
>
> Can I see what forwarders are in use with nslookup?
>
>> I'm not quite sure what you're saying about putting NS entries under
>> forward lookup zones. In Server 2003 you can name "conditional
>
> With NS entries under the forward lookup zones I meant the same as "ls -t NS domain.domain" in nslookup.
>
>> Are you sure you're not naming other, outside-the-domain DNS servers
>> in the server's own DNS IP configuration? That would be the most
>> obvious reason for the error you're seeing, and can open the door to
>> significant network problems.
>
> Yes, fortunately I was clever enough to avoid that :).
>
> --
> I doubt, therefore I might be.
>


.

Relevant Pages

  • Re: ad and dns setup
    ... MCSE, MVP Directory Services ... _msdcs, forward zone, reverse lookup zone. ... To fully rebuild DNS: ... changes immediately to all servers, this helps to speedup the process. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Replication issues
    ... I wanted to say Zone Transfers not Zone Forwarding. ... on 2 servers out of 4 DNS servers. ... DNS and 2003 DNS and how to set up Conditional Forwarding. ...
    (microsoft.public.windows.server.active_directory)
  • Re: ad and dns setup
    ... "Jorge Silva" wrote: ... domain It gave me 2 errors, no dns servers have dns records for this dc ... error no logon servers.. ... Make sure that the _msdcs zone exists and the scope is set ...
    (microsoft.public.windows.server.active_directory)
  • Re: Global catalog server died before completing replication to new GC server
    ... What about the DNS zones,are all machines listed there? ... Install DNS role and create a forward lookup zone for your complete ... Then make sure all servers are listed in the zones, ... cause Group Policy problems. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Very Critical issue
    ... the clients are configured to go to local Domain Controller for DNS query. ... created secondary zone for b.com in the root server of a.com and vise versa. ... As we are migrating all the users first, the file and other servers are ... "Jorge Silva" wrote: ...
    (microsoft.public.windows.server.active_directory)