Link to home
Start Free TrialLog in
Avatar of Dan Arseneau
Dan ArseneauFlag for Canada

asked on

Microsoft AD DNS multi-level subdomain not resolving

Hey all.
Internal Windows 2008 R2 Forest/Domain
Server 2012 R2, DC and DNS.  AD integrated Zone

I'm trying to create a multiple level subdomain but records won't resolve.  I have  I need to create a record in  Records in sub1 work fine but records in sub2 don't resolve.

I created the record at the top level by typing in the sub-levels.  I noticed there are no records at the sub1 or sub2 level except for the record I added.  New Host (A or AAAA) -> -> x.x.x.x

What does a sub-domain container need to pass the query another level down?
Avatar of DrDave242
Flag of United States of America image

Assuming the sub1 and sub2 domains have their own DNS servers, a delegation record for sub2 on the sub1 servers should be sufficient. Alternatively, a stub zone will work as well.
Avatar of Dan Arseneau


Thanks DrDave242.  No additional DNS servers in those domains.  DNS servers are only  at the root level.  Not having them makes sense but I don't want to add additional machines just for this so I'm trying to figure out how to create the stub zone to satisfy a query of  Looking into it...thx
A stub zone won't work in that situation, since it requires at least one master server to pull the SOA and NS records from. (Sorry, I was assuming each zone had at least one server.)

Since the DNS servers are all at the root level, you should be able to create the sub1 domain by right-clicking the root domain's zone and selecting New Domain. Then you can right-click sub1 and select New Domain to create sub2. Finally, you can create records inside sub2 as normal.

Let me know if this is what you've already done and it isn't working.
Yes, I couldn't see how to get the Stub Zone to work.  I have done what you suggested but the final record never resolves.  If I create a record, it resolves, if I create it does not.

So, I have tried create new Domain in called sub1, then in sub1, create a new domain called sub2.  Then add record.

I have added a record under called server.sub2.sub1( and it creates the sub-domains as above but again, doesn't resolve.

Both steps above return no errors but the record cannot be resolved.

It's some sort of DNS restriction but I just can't find out what it is.  Leaning towards delegation being the cause.  I'm in a production environment at the moment so building up a quick lab to test further.

EDIT:  FYI.  Production servers are in but devs want * to be a CNAME to an outside destination.
That's certainly odd. I just did some testing in my own lab, and it worked perfectly. I created sub1 within the root domain, then created sub2 within sub1, then created a host record within sub2. Both ping and nslookup resolved host.sub2.sub1.root.suffix to the correct address.
Ah, then it's something internal that's causing the issue.  That would explain why I couldn't find any answers on the's local.  I guess, my question is still valid; why doesn't it work internally?  You just shifted my investigations to internal, thank you.  If I figure it out, you'll still get points for helping me out.

I just took possession of this domain about a month ago.  I'll keep the question open for a little longer so I can post any findings.
What do you see if you launch nslookup, run the set d2 command to enter verbose debug mode, and query for
For I get a passing grade.  For I get host non-existent...the host record is there.

EDIT: Thanks for sticking it out.
For I get a passing grade.
Does that mean that resolves to an address? If so, what does that address represent?

Along those lines, aside from the sub2 domain, there's not another record named sub2 inside the sub1 domain, is there? It sounds like something is conflicting with the resolution of names in sub2, but I can't yet figure out what it is.
No, it wasn't resolving to an IP, just not returning "non-existent domain" when using NSLOOKUP.  Made me think of I checked.  They're using WINS Forward Lookups for the DNS Zone.  I haven't seen WINS in years so didn't think of it at first.

I'm thinking I'll add search suffixes via GPO and turn it off.  I haven't changed anything yet but I'm pretty sure that's it.  I'm going to keep the ticket open until I make the change so I can post the result.
Yeah, I doubt WINS Forward Lookup is actually being used!
Avatar of Dan Arseneau
Dan Arseneau
Flag of Canada image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Yeah, that is weird. I even did exactly what you did: created the two levels of subdomains and a wildcard CNAME record in sub2, all in the GUI. It resolved perfectly.
Although all good suggestions, none helped me figure this out.