Active Directory Intergrated Zones and DNS replication

Have you gone through this article?

http://technet.microsoft.com/en-us/library/bb727057.aspx

> The really odd thing is that the records we are looking for show up in the Reverse Lookup Zone
> but not the forward lookup zone.

The two are updated separately so that's not necessarily all that telling.

All servers are in the same domain? Or do you have multiple domains in your forest?

What replication scope have you set for the zones in question?

Are all of the DNS Servers Windows 2003?

You're right in thinking that Secondary zones won't help. They won't accept or forward updates.

Chris

Thanks for responding so quickly!  One of the things I did change was the replication in the root of the forest.  I changed it from updating all domain controllers to updating all dns servers in the domain.  I will look into the above suggestions and give you exact answers tomorrow morning.

Dave W.

Hi Dave,

Changing it in that manner means it can only replicate to 2003 DCs, if they all are that's not a problem. As part of the change it moves into it's own directory partition, verify DC=DomainDNSZones,DC=rootdomain,DC=com is replicating to all DCs in the root Domain (repadmin /showreps)?

The "all domain controllers" version cannot replicate outside of the Forest root anyway, so it's not really a big change.

If it were mine I'd set that root domain to replicate to all DNS Servers in the Forest. With delegations for child domains in there it makes communication between all domains trivial. Kind of assumes you have child domains though :)

Chris

Hi Chris,

     They are all in different domains.  Sites are located in Arkansas, NH, Ohio, Hong Kong, China, England and Germany.  We are using Cisco ASA5510's for the router/firewalls and have site tunnels from the parent domain to all of the child domains.  I have changed the parent domain and all the child domains to replicate with all the DNS Servers in the Active Directory Forest.  That should replicate to all of the child domains, etc.  

     When I try to change the DNS Scope  under the forward lookups in the child domains to replicate with all DNS servers in the AD Forest,  I am getting an error "The name limit for the local computer network adapter card has been exceeded."  I am in the process of debugging that error.  One of the solutions mentioned is to delete the child domain from the DNS Forest root, wait to DNS to replicate across the forest and then recreate the child domain in the forest root.  Depending on the time to update the DNS records, most of the domains can be done during the day as they are about 5-13 hrs ahead of the forest root domain.  I am just wondering how long it will take to replicate to the child domains and how often the replication takes to complete.

    Correct me if I am wrong but shouldn't  the DNS Scope changes made at the forest root replicate down to the Active Directory Integrated child domains?.   I have a case archived with MS, that I think I may need to reopen again.  Hopefully you can give me some more insight in to this issue before I call up MS again.

Thanks for all the help!

Dave W.

If you changed the parent to "All DNS Servers in the Forest" then that zone should appear on the DNS Servers for the child domains (provided they are Win 2003). The change in scope should be reflected on all children (provided replication is functioning).

Does your root domain currently have Delegations listed for each of the child domains?

In each child domain, is DNS localised? Meaning, they have their own set of DNS Servers and all systems in the child refer to that DNS server?

Chris

Missed a bit, you can sometimes get the name limit error if a duplicate zone exists. If the scope is currently "all DNS servers ... " open AD Users and Computers, select View and Advanced, then check under System\MicrosoftDNS for a zone matching your current one.

Chris

All the DNS Servers are Windows 2003.  I don't see any of the zones listed under ADUC\System\MicrosoftDNS.  Although, I do see RootDNSServers and a zone we just created for external email access through the DMZ.

I did notice something in the DNS Event Log, Event 713, "An administrator has moved the zone dmitechnology.com to a new location in Active Diretory. The zone will be stored in Active Directory at DC=dmitechnology.com,cn=MicrosoftDNS,DC=ForestDnsZones,DC=dmitechnology,DC=com." which was followed by this error, Event ID 4521, "The DNS server encountered error 32 attempting to load zone dmitechnology.com from Active Directory. The DNS server will attempt to load this zone again on the next timeout cycle. This can be caused by high Active Directory load and may be a transient condition."

I don't know if they have any relevance to the current situation or not, but I thought it might help to clarify a bit.

Not especially unusual in a change like this. It has to tombstone the original DNS zone (and replicate deletion / tombstones) so you can occasionally get a bit of trouble if it tries to access the zone initially.

Is the 4521 error repeating? Try restarting the DNS service and see if it appears then.

Are each of the child domains allowed to update their records? Is it just the forest root that's having this problem?

Chris

   Yes, each of the child domains is allowed to update their records.  No the 4521 error is not constantly repeating.  If you open up DNS on the child domains and try to change the Repl Scope you get the previously mentioned error.

     Why don't I see the domains listed under MicrosoftDNS?  I am going to check the child domains as well but it seems odd that the forest root doesn't have the child domains listed in ADUC\MicrosoftDNS

Dave

I am thinking that what I need to do is trying deleting one of the Asian Zones and see how long it takes replicate to the other zones.  Once that completes, I will add back in the zone, and fingers crossed, hope that all of the info will repopulate the zone.  I am a little nervous about deleting and recreating the zone in question since they are on the same time zone as we are.  How long does replication typically take across a WAN? If I delete and recreate the forward lookup zone for Ohio on the forest root, will there be any service interruption?  Would it be better for me to wait until after hours to complete this task?

Dave

> How long does replication typically take across a WAN?

It depends a little on how you've set the schedule and whether or not sites are chained off one another. In normal circumstances I'd say no more than an hour. It should be noted that you can force it by initiating replication using AD Sites and Services (on each connector).

I would be tempted to do it out of hours anyway. Less chance of it being a problem.

Make sure you note down the delegation entries for each child domain as well as any static records in the zone.

Chris

Sorry I haven't posted in quite a while.  I was able to get microsoft on the line and enlisted one of the tech's who helped me throught a previous issue.  Apparently, our DNS replication was a little bit more confused than I originally imagined.  They are calling back around 1pm EST today to help fix the rest of the mess.  We have changed the replication to All DNS Servers in the forest on the majority of the FLZ's but there are still a few stubborn one's who just don't want to change.  Keep giving me that same error about the network card.  In conclusion, I want to thank Chris-Dent for all the helpful suggestions and support that he has given me towards this issue.  I would like award him all the points even though he didn't really solve the issue.

Thanks very much!!

Dave W.