\\FQDN Does Not Open \\PDC, How to fix in AIX BIND DNS?

Are you really using BIND 8?

Do you permit Dynamic Updates for the zone?

Have you configured BIND 8 to remove the restriction on underscore characters? These are required for Service Record registration.

> My first attempt to fix the problem was a CNAMEthat points FQDN to pdc.FQDN. This did
> not help the problem, ...

It wouldn't really. Use of the CNAME record like that is illegal. It cannot be used for a resource that has another resource already bound (FQDN in this case already has SOA, NS and MX).

The only record you can use at that level in this situation is a Host (A) Record. If Dynamic Updates were permitted they would register automatically.

Chris

What error do you get when  you try to open the shares on the primary domain controller?

Did you run dcdiag?

Also check the system event log.

ping on pdc.FQDN works fine and it resolves to the correct ip address from all computers. We do not currently allow Dynamic DNS updates. We do have some entries in our DNS table the begin with underscores, so I believe that restriction has been removed.

I found out after posting this question that we are also have replication problems betweeen our three domain controllers.

P.S.

\\PDC or \\PDC.FQDN works fine. The only thing that doesn't work is \\FQDN. This may be important for GPO's to work correctly, because the path to GPO's are always:

\\FQDN\sysvol\fqdn\policies\......

Do you have Service Records registered on your DNS Server? Not having those would completely kill replication. They're normally dynamically added, so you have to be quite careful if you don't allow updates.

The records normally registered by a domain controller are held in %SystemRoot%\System32\config\netlogon.dns.

That includes the Host (A) Record for the domain FQDN.

if you add each of those, from every active DC, life should become a lot easier.

Chris

Yep. It'll use Round Robin to provide the answer if multiple A records exist for a single resource. It's normal for an AD domain. You do want to make sure that all IPs quoted are valid and can be reached.

The records as they are now (in netlogon.dns) should be valid in a BIND zone file. Is it failing to load after you add them?

Chris

I haven't tried to add them yet. I will soon. I'm just a little scared of screwing up my MX records again. We have a lot of users who notice when they can't receive email.

BIND complains about Duplicate A records:

FQDN     600    IN      A      1.2.3.4 <---- ip of PDC
FQDN     600    IN      A      1.2.3.5 <---- ip of BDC1
FQDN     600    IN      A      1.2.3.6 <---- ip of BDC2


but when I do an nslookup on FQDN i get the results I want:

Name:   FQDN
Addresses:  1.2.3.4, 1.2.3.5, 1.2.3.6

Should I ignore error?

Odd, it shouldn't mind that at all. I wonder if BIND 8 uses Round Robin by default. I'll see if I can look when I get home. Never used BIND 8, was introduced to DNS on 9 ;)

Chris