DNS Update Issue
-
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@PhlipElder said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
ad.domain.com theoretically. Everything I've ever touched is already in place. Although i'd love to rebuild my families infrastructure from the ground up.
If it looks like this, then it owns domain.com
Oh man, what a mess.
Meh, not bad actually. Perfect? No. But small enough to not be a problem really.
Definitely not what I would do now if I set it up new.
This is just a throw back to the new days of AD. MS suggested just this - then after a while they suggested domain.local for the internal domain, and now they recommend ad.domain.com for the internal domain.
MS originally suggested domain.local and stuck to it for a long time. That's how it started.
Pretty sure domain.local wasn't the thing in Windows 2000 days, that came in 2003 and lasted, as you said, a long time.
In 2000, it was simply
domainMan - I know that a TON of people did that - but I didn't think that was the actual recommendation. I guess I'd have to find some old Win2K docs....
I inherited a server 2003 that was set up like that.
-
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@PhlipElder said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
ad.domain.com theoretically. Everything I've ever touched is already in place. Although i'd love to rebuild my families infrastructure from the ground up.
If it looks like this, then it owns domain.com
Oh man, what a mess.
Meh, not bad actually. Perfect? No. But small enough to not be a problem really.
Definitely not what I would do now if I set it up new.
This is just a throw back to the new days of AD. MS suggested just this - then after a while they suggested domain.local for the internal domain, and now they recommend ad.domain.com for the internal domain.
MS originally suggested domain.local and stuck to it for a long time. That's how it started.
Pretty sure domain.local wasn't the thing in Windows 2000 days, that came in 2003 and lasted, as you said, a long time.
In 2000, it was simply
domainMan - I know that a TON of people did that - but I didn't think that was the actual recommendation. I guess I'd have to find some old Win2K docs....
I don't know about MS recommendation, but when I was setting up NT4 networks prior to 2000, it was the recommendation from the company on how to setup their stuff.
-
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@PhlipElder said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
ad.domain.com theoretically. Everything I've ever touched is already in place. Although i'd love to rebuild my families infrastructure from the ground up.
If it looks like this, then it owns domain.com
Oh man, what a mess.
Meh, not bad actually. Perfect? No. But small enough to not be a problem really.
Definitely not what I would do now if I set it up new.
This is just a throw back to the new days of AD. MS suggested just this - then after a while they suggested domain.local for the internal domain, and now they recommend ad.domain.com for the internal domain.
MS originally suggested domain.local and stuck to it for a long time. That's how it started.
Pretty sure domain.local wasn't the thing in Windows 2000 days, that came in 2003 and lasted, as you said, a long time.
In 2000, it was simply
domainMan - I know that a TON of people did that - but I didn't think that was the actual recommendation. I guess I'd have to find some old Win2K docs....
I don't know about MS recommendation, but when I was setting up NT4 networks prior to 2000, it was the recommendation from the company on how to setup their stuff.
NT4, yes. But it behaved differently. AD I thought started with the .local recommendation.
-
@scottalanmiller said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@PhlipElder said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
ad.domain.com theoretically. Everything I've ever touched is already in place. Although i'd love to rebuild my families infrastructure from the ground up.
If it looks like this, then it owns domain.com
Oh man, what a mess.
Meh, not bad actually. Perfect? No. But small enough to not be a problem really.
Definitely not what I would do now if I set it up new.
This is just a throw back to the new days of AD. MS suggested just this - then after a while they suggested domain.local for the internal domain, and now they recommend ad.domain.com for the internal domain.
MS originally suggested domain.local and stuck to it for a long time. That's how it started.
Pretty sure domain.local wasn't the thing in Windows 2000 days, that came in 2003 and lasted, as you said, a long time.
In 2000, it was simply
domainMan - I know that a TON of people did that - but I didn't think that was the actual recommendation. I guess I'd have to find some old Win2K docs....
I don't know about MS recommendation, but when I was setting up NT4 networks prior to 2000, it was the recommendation from the company on how to setup their stuff.
NT4, yes. But it behaved differently. AD I thought started with the .local recommendation.
We have a .local here
-
@wirestyle22 said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@PhlipElder said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
ad.domain.com theoretically. Everything I've ever touched is already in place. Although i'd love to rebuild my families infrastructure from the ground up.
If it looks like this, then it owns domain.com
Oh man, what a mess.
Meh, not bad actually. Perfect? No. But small enough to not be a problem really.
Definitely not what I would do now if I set it up new.
This is just a throw back to the new days of AD. MS suggested just this - then after a while they suggested domain.local for the internal domain, and now they recommend ad.domain.com for the internal domain.
MS originally suggested domain.local and stuck to it for a long time. That's how it started.
Pretty sure domain.local wasn't the thing in Windows 2000 days, that came in 2003 and lasted, as you said, a long time.
In 2000, it was simply
domainMan - I know that a TON of people did that - but I didn't think that was the actual recommendation. I guess I'd have to find some old Win2K docs....
I don't know about MS recommendation, but when I was setting up NT4 networks prior to 2000, it was the recommendation from the company on how to setup their stuff.
NT4, yes. But it behaved differently. AD I thought started with the .local recommendation.
We have a .local here
same
-
man, after reading all this, I am pretty sure my DNS is not correct.
-
I'm just curious--what is it that we could prevent from occurring by putting DC2 first for DNS in DC1? In what scenario would we fail a lookup on ourself but succeed with a lookup? If replication is occurring they are the same. If replication is not occurring there is no guarantee that DC2 will have what you need vs. DC1.
Idk what I thought this for so long
-
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@PhlipElder said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
ad.domain.com theoretically. Everything I've ever touched is already in place. Although i'd love to rebuild my families infrastructure from the ground up.
If it looks like this, then it owns domain.com
Oh man, what a mess.
Meh, not bad actually. Perfect? No. But small enough to not be a problem really.
Definitely not what I would do now if I set it up new.
This is just a throw back to the new days of AD. MS suggested just this - then after a while they suggested domain.local for the internal domain, and now they recommend ad.domain.com for the internal domain.
Being a part of the SBS crew from the BackOffice 4.0 and 4.5 (NT) days, the .Local phenomena started around the discussion of Internet domain registration and keeping the internal and internet domains separate. That was prior to SBS 2003 that was the first product to deploy out of the box with .Local.
Some had to do with the confusion around registering the internet domain that was to be used internally. We used to encounter companies with Domain.Com that did not own the internet domain. It was painful to say the least.
AD was still relatively new so no one really new what to do about internal and external DNS though SBS 2003 did split the DNS for Remote.Domain.Com.
Besides wizards, which were primarily in the SBS realm, splitting the DNS became the norm and eventually the recommendation came about for Corp.Domain.Com with the caveat that the internet domain should be owned.
So, here we are. Most companies own their internet domains so it's a no-brainer to split the DNS for their setups.
-
It really doesn't matter so much. Many places .com works great, many .local works great. Some, like mine, AD is .local but we also have onprem .com and public .com. Any issues? Not a single one, ever.
For the DNS server itself, it's own FQDN first, secondary DNS server(s) next, loopback last. For DNS or DHCP, you can have CF in there too.
-
@Donahue said in DNS Update Issue:
man, after reading all this, I am pretty sure my DNS is not correct.
I think I am with ya on this one.
So let me get this straight. On DC0 with AD Integrated DNS, Preferred DNS should be IP address of DC0 and Alternate DNS should be 127.0.0.1?
Currently I point DC0 Preferred to itself and Alternate to DC1. I have not had any issue over the last X amount of years so I don't know what the actual issue is with my current setup.
I currently have a .local also (setup by a contractor a long time ago).
-
@pmoncho No. The only entry should be 127.0.0.1. Always loopback.
-
@pmoncho said in DNS Update Issue:
@Donahue said in DNS Update Issue:
man, after reading all this, I am pretty sure my DNS is not correct.
I think I am with ya on this one.
So let me get this straight. On DC0 with AD Integrated DNS, Preferred DNS should be IP address of DC0 and Alternate DNS should be 127.0.0.1?
Currently I point DC0 Preferred to itself and Alternate to DC1. I have not had any issue over the last X amount of years so I don't know what the actual issue is with my current setup.
I currently have a .local also (setup by a contractor a long time ago).
There is no issue with your setup.
It's possible that the NIC itself could have an issue which would make your use of the actual IP fail connectivity, but the loopback would still function - but, I said there was an issue with the NIC, so does it matter if the loopback works when you can't get on the network?
As for having a secondary DNS entry - it protects you against the local DNS service itself failing, provides you a backup, just like secondary DNS to client machines have a backup DNS server to communicate with.
-
@Dashrender said in DNS Update Issue:
@pmoncho said in DNS Update Issue:
@Donahue said in DNS Update Issue:
man, after reading all this, I am pretty sure my DNS is not correct.
I think I am with ya on this one.
So let me get this straight. On DC0 with AD Integrated DNS, Preferred DNS should be IP address of DC0 and Alternate DNS should be 127.0.0.1?
Currently I point DC0 Preferred to itself and Alternate to DC1. I have not had any issue over the last X amount of years so I don't know what the actual issue is with my current setup.
I currently have a .local also (setup by a contractor a long time ago).
There is no issue with your setup.
It's possible that the NIC itself could have an issue which would make your use of the actual IP fail connectivity, but the loopback would still function - but, I said there was an issue with the NIC, so does it matter if the loopback works when you can't get on the network?As for having a secondary DNS entry - it protects you against the local DNS service itself failing, provides you a backup, just like secondary DNS to client machines have a backup DNS server to communicate with.
If the dns service fails on DC1 though, wouldn't the reference to dc2 fail too and thus switch to the second dns entry, DC2 for the workstation
-
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@pmoncho said in DNS Update Issue:
@Donahue said in DNS Update Issue:
man, after reading all this, I am pretty sure my DNS is not correct.
I think I am with ya on this one.
So let me get this straight. On DC0 with AD Integrated DNS, Preferred DNS should be IP address of DC0 and Alternate DNS should be 127.0.0.1?
Currently I point DC0 Preferred to itself and Alternate to DC1. I have not had any issue over the last X amount of years so I don't know what the actual issue is with my current setup.
I currently have a .local also (setup by a contractor a long time ago).
There is no issue with your setup.
It's possible that the NIC itself could have an issue which would make your use of the actual IP fail connectivity, but the loopback would still function - but, I said there was an issue with the NIC, so does it matter if the loopback works when you can't get on the network?As for having a secondary DNS entry - it protects you against the local DNS service itself failing, provides you a backup, just like secondary DNS to client machines have a backup DNS server to communicate with.
If the dns service fails on DC1 though, wouldn't the reference to the dc fail too and thus switch to the second dns entry, DC2 for the workstation
That is what I want to happen correct? As long as replication between the two DC's was fine prior to the issue with DC1. Am I missing something?
-
@pmoncho said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@pmoncho said in DNS Update Issue:
@Donahue said in DNS Update Issue:
man, after reading all this, I am pretty sure my DNS is not correct.
I think I am with ya on this one.
So let me get this straight. On DC0 with AD Integrated DNS, Preferred DNS should be IP address of DC0 and Alternate DNS should be 127.0.0.1?
Currently I point DC0 Preferred to itself and Alternate to DC1. I have not had any issue over the last X amount of years so I don't know what the actual issue is with my current setup.
I currently have a .local also (setup by a contractor a long time ago).
There is no issue with your setup.
It's possible that the NIC itself could have an issue which would make your use of the actual IP fail connectivity, but the loopback would still function - but, I said there was an issue with the NIC, so does it matter if the loopback works when you can't get on the network?As for having a secondary DNS entry - it protects you against the local DNS service itself failing, provides you a backup, just like secondary DNS to client machines have a backup DNS server to communicate with.
If the dns service fails on DC1 though, wouldn't the reference to the dc fail too and thus switch to the second dns entry, DC2 for the workstation
That is what I want to happen correct? As long as replication between the two DC's was fine prior to the issue with DC1. Am I missing something?
I'm saying the reference to DC2 from DC1 doesn't matter if the dns service fails on DC1. It would stop referencing DC2, right? Specifically replying to @Dashrender's comment.
-
@wirestyle22 said in DNS Update Issue:
@pmoncho said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@pmoncho said in DNS Update Issue:
@Donahue said in DNS Update Issue:
man, after reading all this, I am pretty sure my DNS is not correct.
I think I am with ya on this one.
So let me get this straight. On DC0 with AD Integrated DNS, Preferred DNS should be IP address of DC0 and Alternate DNS should be 127.0.0.1?
Currently I point DC0 Preferred to itself and Alternate to DC1. I have not had any issue over the last X amount of years so I don't know what the actual issue is with my current setup.
I currently have a .local also (setup by a contractor a long time ago).
There is no issue with your setup.
It's possible that the NIC itself could have an issue which would make your use of the actual IP fail connectivity, but the loopback would still function - but, I said there was an issue with the NIC, so does it matter if the loopback works when you can't get on the network?As for having a secondary DNS entry - it protects you against the local DNS service itself failing, provides you a backup, just like secondary DNS to client machines have a backup DNS server to communicate with.
If the dns service fails on DC1 though, wouldn't the reference to the dc fail too and thus switch to the second dns entry, DC2 for the workstation
That is what I want to happen correct? As long as replication between the two DC's was fine prior to the issue with DC1. Am I missing something?
I'm saying the reference to DC2 from DC1 doesn't matter if the dns service fails on DC1. It would stop referencing DC2, right? Specifically replying to @Dashrender's comment.
Oh, I see what your saying. Good question and I am awaiting that answer.
-
@wirestyle22 said in DNS Update Issue:
@pmoncho said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@pmoncho said in DNS Update Issue:
@Donahue said in DNS Update Issue:
man, after reading all this, I am pretty sure my DNS is not correct.
I think I am with ya on this one.
So let me get this straight. On DC0 with AD Integrated DNS, Preferred DNS should be IP address of DC0 and Alternate DNS should be 127.0.0.1?
Currently I point DC0 Preferred to itself and Alternate to DC1. I have not had any issue over the last X amount of years so I don't know what the actual issue is with my current setup.
I currently have a .local also (setup by a contractor a long time ago).
There is no issue with your setup.
It's possible that the NIC itself could have an issue which would make your use of the actual IP fail connectivity, but the loopback would still function - but, I said there was an issue with the NIC, so does it matter if the loopback works when you can't get on the network?As for having a secondary DNS entry - it protects you against the local DNS service itself failing, provides you a backup, just like secondary DNS to client machines have a backup DNS server to communicate with.
If the dns service fails on DC1 though, wouldn't the reference to the dc fail too and thus switch to the second dns entry, DC2 for the workstation
That is what I want to happen correct? As long as replication between the two DC's was fine prior to the issue with DC1. Am I missing something?
I'm saying the reference to DC2 from DC1 doesn't matter if the dns service fails on DC1. It would stop referencing DC2, right? Specifically replying to @Dashrender's comment.
You're mixing things together. DNS server service and syncing is it's own thing.
The IP stack referencing a DNS server based on the DNS primary and DNS secondary in the IP settings are completely separate. -
@Dashrender said in DNS Update Issue:
As for having a secondary DNS entry - it protects you against the local DNS service itself failing, provides you a backup, just like secondary DNS to client machines have a backup DNS server to communicate with.
No. You don’t put anything in there. The local DNS service is not going to fail. If it does, the. You have a fail state just like any other fail state and you deal with it.
-
DNS servers run two services
- DNS Server Service
- DNS Client Service
Client machines only run one
- DNS Client Service
In the case where an AD w/integrated DNS has it's DNS Server Service fail, the DNS Client Service is likely unaffected. So the DNS Client Service will see (rather not see a response) a failure from the local (primary DNS) and failover to the secondary DNS.
-
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
As for having a secondary DNS entry - it protects you against the local DNS service itself failing, provides you a backup, just like secondary DNS to client machines have a backup DNS server to communicate with.
No. You don’t put anything in there. The local DNS service is not going to fail. If it does, the. You have a fail state just like any other fail state and you deal with it.
Why hamstring the whole system because a single service failed. I'm already mentioned that it's extremely unlikely that DNS Server will fail on its own, but it is possible.
