DNS Update Issue
-
I was at my families business the other week and one of my family members explained an issue with drive mappings they've had for years and while building them a VM I can't ping the domain from inside their network but I can from outside. No one has been able to fix this issue they say. I log into their domain controllers and I see the forwarders are set to local addresses and one of the DC's has nothing set for forwarding at all. I check the DNS settings for the local machine and it has a mix of public and private addresses. So I set DC1's first DNS entry to DC2 with itself as the second entry by IP address, not loopback. DC2's first entry to DC1 with itself as the second entry by IP address, not loopback. I set the forwaders correctly. DC3 is entered as a tertiary DNS entry--although I have no idea why they have three DC's. We are able to ping external addresses now, so I finish setting everything up for their rocketchat VM and I leave. Well, the next friday I come in to work on another VM (bookstack) and I can't ping the domain from inside their network but I can from outside again. I check the domain controllers again and everything is set correctly. The domain forwarding was set well over a week ago and should have been pushed through already. I had him test it again today and it still will not resolve. I won't be able to check this again until I go back this coming Friday but I wanted to see what you guys had to say about this.
-
What does nslookup tell you?
-
@scottalanmiller it tells me it's requesting from the primary dc and that the dc doesn't know what the address is.
Can't find, non-existent domain
Should've been resolved by fixing the forwarders
-
@wirestyle22 said in DNS Update Issue:
@scottalanmiller it tells me it's requesting from the primary dc and that the dc doesn't know what the address is.
Can't find, non-existent domain
Should've been resolved by fixing the forwarders
Nope. The local DNS server likely "owns" domain.com
So you will have to put in records for the public sutff on domain.com. This is perfectly normal "split brain" DNS setup typical in almost every Windows shop on the planet.
-
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@scottalanmiller it tells me it's requesting from the primary dc and that the dc doesn't know what the address is.
Can't find, non-existent domain
Should've been resolved by fixing the forwarders
Nope. The local DNS server likely "owns" domain.com
So you will have to put in records for the public sutff on domain.com. This is perfectly normal "split brain" DNS setup typical in almost every Windows shop on the planet.
Bingo!
-
So the reference to the website is on a local dns server and since the local server has no A record it's never hitting the forwarders because it's assuming it doesn't exist
-
@wirestyle22 said in DNS Update Issue:
So the reference to the website is on a local dns server and since the local server has no A record it's never hitting the forwarders because it's assuming it doesn't exist
If it's a Primary Zone (which it probably is) it will never go to forwarders from itself. It just assumes it knows everything about the Zone.
-
@wirestyle22 said in DNS Update Issue:
So the reference to the website is on a local dns server and since the local server has no A record it's never hitting the forwarders because it's assuming it doesn't exist
Correct.
To fix this, you need to add the records for that domain to your local DNS. The main issue you will likely run into is the no host domain name. i.e. microsoft.com... this would belong to your AD servers I believe, and you don't want to change that to point to your web server.
-
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
-
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
-
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
ad.domain.com theoretically. Everything I've ever touched is already in place. Although i'd love to rebuild my families infrastructure from the ground up.
-
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
He's too young to know the old days.
-
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
He's too young to know the old days.
wat explain old man
-
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
ad.domain.com theoretically. Everything I've ever touched is already in place. Although i'd love to rebuild my families infrastructure from the ground up.
If it looks like this, then it owns domain.com
-
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
ad.domain.com theoretically. Everything I've ever touched is already in place. Although i'd love to rebuild my families infrastructure from the ground up.
If it looks like this, then it owns domain.com
It does
-
The red box not masking, is the A record for domain.com
Everything here is subdomain.domain.com and has matching records on CloudFlare for when not in the office...
-
Are these Active Directory based domain controllers with AD integrated DNS set up?
Then DNS0 on all DCs should point to itself only. By default no other DNS server IP entry should be set on the NIC other than 127.0.0.1. Ever.
AD integrated DNS takes care of replicating changes and IDs among the DCs in a given forest/domain.
Never, ever, put a public DNS server anywhere but in the Forwarders location on an AD integrated DNS server.
DHCP should be handing out DNS entries for the AD DC DNS servers local to them or a tertiary if need-be for redundancy.
It sounds like whomever set things up had no idea how DNS works.
-
@PhlipElder totally.
-
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
ad.domain.com theoretically. Everything I've ever touched is already in place. Although i'd love to rebuild my families infrastructure from the ground up.
If it looks like this, then it owns domain.com
Oh man, what a mess.
-
@PhlipElder said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
Simple case of me never doing this wrong I guess. What a weird thing to screw up. Didn't really have time to sift through it all.
What do you normally use for your top level domain on an AD build?
ad.domain.com theoretically. Everything I've ever touched is already in place. Although i'd love to rebuild my families infrastructure from the ground up.
If it looks like this, then it owns domain.com
Oh man, what a mess.
Meh, not bad actually. Perfect? No. But small enough to not be a problem really.
Definitely not what I would do now if I set it up new.
