Solved

DNS - use Internal or External (performance)

Posted on 2016-10-14
6
49 Views
Last Modified: 2016-10-25
Hi
Can someone help me gauge whether or not its best to use internal DNS servers or use say the ISP DNS servers?
We are using internal, 4x DCs with DNS on over two sites recently performance of internet has dropped.  Not sure if this is o365 related or not either, however when a DC goes offline it causes much issue and takes a lot of time for logons to work etc.
Wondered if pointing DNS externally will help with the above or anything else?
thanks
0
Comment
Question by:CHI-LTD
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 21

Accepted Solution

by:
CompProbSolv earned 250 total points
ID: 41843369
Are you asking if local workstations should use the local DCs or your ISP DNS servers for DNS?  Definitely the local DCs.  The primary reason is that your ISPs DNS servers won't know how to resolve local addresses which will cause you no end of problems.

You can configure the DNS servers in your local DCs to use the ISP DNS servers for forwarding if those servers seem reasonable.
0
 
LVL 6

Expert Comment

by:Niten Kumar
ID: 41843378
Logon problems means issues with your dc's.  What kind of problems do you have when a particular dc goes offline? How many sites do you have and how are the dc's distributed amongst the sites. Are sites properly defined and have you checked dc and replication health.
0
 
LVL 1

Author Comment

by:CHI-LTD
ID: 41843394
ok will leave clients pointing to local dcs.
will give server dns changes some more thought.

So if one DC was offline for maintenance other servers (not sure about clients) would say there are no logon servers to process account (or similar) but there is still one other DC available.  

I have 4x DCs.  2x at site a and 2 at site b.

The clients point to site a and also have the site b in the tcpip settings, but down the list.

dcdiag reports fine
0
Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 
LVL 6

Expert Comment

by:Niten Kumar
ID: 41843400
Can you type set at command prompt on the machines that cause logon problems and check what is displayed under logon server
0
 
LVL 6

Assisted Solution

by:Niten Kumar
Niten Kumar earned 250 total points
ID: 41843401
The computers at site b should output the one of the dcs at site b as the logon server. Likewise for site a.
0
 
LVL 1

Author Closing Comment

by:CHI-LTD
ID: 41858303
let using local, but may look at pointing internal DNS servers to Google.
0

Featured Post

Webinar: Aligning, Automating, Winning

Join Dan Russo, Senior Manager of Operations Intelligence, for an in-depth discussion on how Dealertrack, leading provider of integrated digital solutions for the automotive industry, transformed their DevOps processes to increase collaboration and move with greater velocity.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html?cid=Gene_Skyport) provided 218 attendees with a step-by-step guide for…
In-place Upgrading Dirsync to Azure AD Connect
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question