DNS Update Issue
-
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
Correct - that's how the client works.
But the server is also a client. Active Directory needs to make a DNS call - so it looks to the IP stack and gets the primary DNS server IP - which fails to respond. If there is no secondary DNS server, the AD service on this server now fails. BUT if you have a secondary DNS entry in the IP settings, then the IP stack will flip over to using the secondary DNS listed... and now get a response for Active Directory.
If 127.0.0.1 fails to respond to a DNS request, you have issues that need resolved. Dont mask it.
then there is never a reason to give a client a secondary DNS either - don't mask that problem.
Or to have a second AD / DNS at all, since all of that is to mask failures from the end users.
Masking problems isn't the goal but it's a side effect of doing it this way
No more so than having RAID masks the problem. So it's better to have end user impact on DNS than it is from a drive failure?
Valid
-
@Donahue said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@Donahue said in DNS Update Issue:
Ok, I am definitely getting confused between the DNS client settings that are set at the NIC, and some other internal setting in the DNS manager.
@JaredBusch Where are you saying we should set the loopback? What should the NIC settings be?
NIC to loopback, not the forwarders, forwarders can't look to the loopback, that would break a lot of things.
I have no idea what you are saying. This is my NIC settings currently on my local DC. The first one is it's own IP, but not loopback.
First one should be loopback, loopback is faster and more reliable than the local IP, it bypasses part of the network stack.
The secondary should be a different DNS server, which it is. So that's correct.
-
@Donahue said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Donahue The first one (It's own IP) should be 127.0.0.1 is what they are saying
That's what I thought. What about settings for the DNS server service?
The server cannot point to itself. DNS servers have forwarders, it's a different concept.
-
@Dashrender said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Donahue The first one (It's own IP) should be 127.0.0.1 is what they are saying
That's what I thought. What about settings for the DNS server service?
The DNS server (via DNS Manager) should have it's forwarders set to whatever service you want to use as your upstream resolution provider (I use Google - some people pay Umbrella, so they use Umbrella).
I use CloudFlare. Just throwing that out there.
-
@scottalanmiller said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Donahue The first one (It's own IP) should be 127.0.0.1 is what they are saying
That's what I thought. What about settings for the DNS server service?
The server cannot point to itself. DNS servers have forwarders, it's a different concept.
It can, it's just a terrible idea. This was the case with my families business.
-
@Dashrender said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Donahue The first one (It's own IP) should be 127.0.0.1 is what they are saying
That's what I thought. What about settings for the DNS server service?
The DNS server (via DNS Manager) should have it's forwarders set to whatever service you want to use as your upstream resolution provider (I use Google - some people pay Umbrella, so they use Umbrella).
ok, weird. One of my DC's, the one at my location, is set to only google. The other at my branch is set to the DC at my location, then our two ISP provided servers, and then finally to google.
-
@wirestyle22 said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Donahue The first one (It's own IP) should be 127.0.0.1 is what they are saying
That's what I thought. What about settings for the DNS server service?
The server cannot point to itself. DNS servers have forwarders, it's a different concept.
It can, it's just a terrible idea. This was the case with my families business.
That'll definitely break all kinds of things.
-
@Donahue said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Donahue The first one (It's own IP) should be 127.0.0.1 is what they are saying
That's what I thought. What about settings for the DNS server service?
The DNS server (via DNS Manager) should have it's forwarders set to whatever service you want to use as your upstream resolution provider (I use Google - some people pay Umbrella, so they use Umbrella).
ok, weird. One of my DC's, the one at my location, is set to only google. The other at my branch is set to the DC at my location, then our two ISP provided servers, and then finally to google.
He means it shouldn't be, not that it can't. It can be listed but it doesn't function correctly when it's set that way.
-
@scottalanmiller said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Donahue The first one (It's own IP) should be 127.0.0.1 is what they are saying
That's what I thought. What about settings for the DNS server service?
The server cannot point to itself. DNS servers have forwarders, it's a different concept.
It can, it's just a terrible idea. This was the case with my families business.
That'll definitely break all kinds of things.
Yeah I immediately changed it. One of the DC's had no forwarders at all!
-
@wirestyle22 said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Donahue The first one (It's own IP) should be 127.0.0.1 is what they are saying
That's what I thought. What about settings for the DNS server service?
The server cannot point to itself. DNS servers have forwarders, it's a different concept.
It can, it's just a terrible idea. This was the case with my families business.
That'll definitely break all kinds of things.
Yeah I immediately changed it. One of the DC's had no forwarders at all!
This is actually less of an issue. Windows DNS servers have root hints - so if there are no forwarders listed, the query will be sent to a root server.
-
@Donahue said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Donahue The first one (It's own IP) should be 127.0.0.1 is what they are saying
That's what I thought. What about settings for the DNS server service?
The DNS server (via DNS Manager) should have it's forwarders set to whatever service you want to use as your upstream resolution provider (I use Google - some people pay Umbrella, so they use Umbrella).
ok, weird. One of my DC's, the one at my location, is set to only google. The other at my branch is set to the DC at my location, then our two ISP provided servers, and then finally to google.
You DNS Forwarders are set to only google? ok - so what's the problem? There is nothing wrong with that.
-
@Dashrender said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Donahue The first one (It's own IP) should be 127.0.0.1 is what they are saying
That's what I thought. What about settings for the DNS server service?
The DNS server (via DNS Manager) should have it's forwarders set to whatever service you want to use as your upstream resolution provider (I use Google - some people pay Umbrella, so they use Umbrella).
ok, weird. One of my DC's, the one at my location, is set to only google. The other at my branch is set to the DC at my location, then our two ISP provided servers, and then finally to google.
You DNS Forwarders are set to only google? ok - so what's the problem? There is nothing wrong with that.
He has another that is set internally
-
@Dashrender said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Donahue The first one (It's own IP) should be 127.0.0.1 is what they are saying
That's what I thought. What about settings for the DNS server service?
The DNS server (via DNS Manager) should have it's forwarders set to whatever service you want to use as your upstream resolution provider (I use Google - some people pay Umbrella, so they use Umbrella).
ok, weird. One of my DC's, the one at my location, is set to only google. The other at my branch is set to the DC at my location, then our two ISP provided servers, and then finally to google.
You DNS Forwarders are set to only google? ok - so what's the problem? There is nothing wrong with that.
It's that both my DC's are different, that's the weird part.
-
So thought experiment:
If DC1 and DC2 have 127.0.0.1 as their only DNS entry and their forwarders are only set to each other, how does that resolve? Can the DC's tell the difference between a forwarding request and a normal DNS request? Otherwise wouldn't this time out?
-
@Donahue said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@Donahue said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Donahue The first one (It's own IP) should be 127.0.0.1 is what they are saying
That's what I thought. What about settings for the DNS server service?
The DNS server (via DNS Manager) should have it's forwarders set to whatever service you want to use as your upstream resolution provider (I use Google - some people pay Umbrella, so they use Umbrella).
ok, weird. One of my DC's, the one at my location, is set to only google. The other at my branch is set to the DC at my location, then our two ISP provided servers, and then finally to google.
You DNS Forwarders are set to only google? ok - so what's the problem? There is nothing wrong with that.
It's that both my DC's are different, that's the weird part.
That was just someone not knowing what they were doing. it would be awesome if DNS replicated that setting as well - but I'm sure there are reasons to not do that.
i.e. using an IP of a local forward lookup based on region. -
right, but I wonder if my branch DC should be pointing to the HQ DC, or just going straight to external?
-
@wirestyle22 said in DNS Update Issue:
So thought experiment:
If DC1 and DC2 have 127.0.0.1 as their only DNS entry and their forwarders are only set to each other, how does that resolve?
It doesn't. The local system doesn't know about other domains so there would be either no response or a failure response. But really it would also result in an infinite loop.
-
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
So thought experiment:
If DC1 and DC2 have 127.0.0.1 as their only DNS entry and their forwarders are only set to each other, how does that resolve?
It doesn't. The local system doesn't know about other domains so there would be either no response or a failure response. But really it would also result in an infinite loop.
Right which would timeout.
-
@Donahue said in DNS Update Issue:
right, but I wonder if my branch DC should be pointing to the HQ DC, or just going straight to external?
AD Integrated forwarders should NEVER point toward internal sources like that.. their purpose is to get information about domains it does not know about. AD integrated forwards have all of the local data on all DNS servers. There would be nothing to gain by sending to another internal DNS server. They should make their request to an outside, upstream source.
-
I just did an experiment and disabled the NIC on my HQ DC. DNS is still able to resolve like normal, so I assume things are fine there. I will check the branch too. For some reason we recently had issues with one DC being down, and DNS being down too, as if it didnt failover to the other DC.
