DNS Update Issue
-
DNS servers run two services
- DNS Server Service
- DNS Client Service
Client machines only run one
- DNS Client Service
In the case where an AD w/integrated DNS has it's DNS Server Service fail, the DNS Client Service is likely unaffected. So the DNS Client Service will see (rather not see a response) a failure from the local (primary DNS) and failover to the secondary DNS.
-
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
As for having a secondary DNS entry - it protects you against the local DNS service itself failing, provides you a backup, just like secondary DNS to client machines have a backup DNS server to communicate with.
No. You don’t put anything in there. The local DNS service is not going to fail. If it does, the. You have a fail state just like any other fail state and you deal with it.
Why hamstring the whole system because a single service failed. I'm already mentioned that it's extremely unlikely that DNS Server will fail on its own, but it is possible.
-
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
-
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
@wirestyle22 I don't think you are missing anything, we discussed that yesterday over PM and it is as you said. I for some reason thought differently although I knew DNS replicate automatically through AD. As it is, you shouldn't need to use another DNS Server on DC1 or viceversa on DC2.
-
@dbeato eh? We didn't talk in PM yesterday. Was it someone else? Last thing we spoke about was ansible I thought
-
@wirestyle22 said in DNS Update Issue:
@dbeato eh? We didn't talk in PM yesterday. Was it someone else? Last thing we spoke about was ansible I thought
Sorry no PM,Telegram!
-
@dbeato said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@dbeato eh? We didn't talk in PM yesterday. Was it someone else? Last thing we spoke about was ansible I thought
Sorry no PM,Telegram!
Oh the group. Sure we were all talking.
-
@Dashrender said in DNS Update Issue:
DNS servers run two services
- DNS Server Service
- DNS Client Service
Client machines only run one
- DNS Client Service
In the case where an AD w/integrated DNS has it's DNS Server Service fail, the DNS Client Service is likely unaffected. So the DNS Client Service will see (rather not see a response) a failure from the local (primary DNS) and failover to the secondary DNS.
So, you are intentionally breaking the DNS design, to hide the fact that the DNS server is broken.
What is the point of this?
-
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
Correct - that's how the client works.
But the server is also a client. Active Directory needs to make a DNS call - so it looks to the IP stack and gets the primary DNS server IP - which fails to respond. If there is no secondary DNS server, the AD service on this server now fails. BUT if you have a secondary DNS entry in the IP settings, then the IP stack will flip over to using the secondary DNS listed... and now get a response for Active Directory.
-
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
You are mixing things, just fucking stop.
This discussion is strictly related to DNS server functionality. Client connectivity is unrelated.
Of course DC1 needs a reference to DC2 in its own DNS tables, because it is all replicated and all systems know all. This also has nothing to do with NIC DNS settings..
NIC DNS settings are strictly for the DNS client service on a system to access..
-
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
Correct - that's how the client works.
But the server is also a client. Active Directory needs to make a DNS call - so it looks to the IP stack and gets the primary DNS server IP - which fails to respond. If there is no secondary DNS server, the AD service on this server now fails. BUT if you have a secondary DNS entry in the IP settings, then the IP stack will flip over to using the secondary DNS listed... and now get a response for Active Directory.
If 127.0.0.1 fails to respond to a DNS request, you have issues that need resolved. Dont mask it.
-
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
DNS servers run two services
- DNS Server Service
- DNS Client Service
Client machines only run one
- DNS Client Service
In the case where an AD w/integrated DNS has it's DNS Server Service fail, the DNS Client Service is likely unaffected. So the DNS Client Service will see (rather not see a response) a failure from the local (primary DNS) and failover to the secondary DNS.
So, you are intentionally breaking the DNS design, to hide the fact that the DNS server is broken.
What is the point of this?
WTH are you talking about?
If a client machine is talking to DC01's AD services, and those services try talking to DNS on DC01, and the DNS service is failed, then the client will be impacted.
You consider it better to impact the client than have an automated solution to keep them working? If you need to be so Johnny on the spot for the DNS service on each server to be running - then you need some kind of monitor system telling you that that DNS is down, while still allowing the clients to auto failover and keep working.
Hell - this is hardly any different than setting up the DNS solution you've been using for a while where Primary is the AD/DNS server, secondary is the router, and on the router, first forwarder is AD/DNS and Secondary is google or something.
It's all to keep things as transparent as possible for then clients. If you don't need transparency at the AD level, then you definitely don't need it at the network level either.
-
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
You are mixing things, just fucking stop.
This discussion is strictly related to DNS server functionality. Client connectivity is unrelated.
Of course DC1 needs a reference to DC2 in its own DNS tables, because it is all replicated and all systems know all. This also has nothing to do with NIC DNS settings..
NIC DNS settings are strictly for the DNS client service on a system to access..
OMFG - I've been very specific that it's about the DNS client service - go back and read.
-
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
Correct - that's how the client works.
But the server is also a client. Active Directory needs to make a DNS call - so it looks to the IP stack and gets the primary DNS server IP - which fails to respond. If there is no secondary DNS server, the AD service on this server now fails. BUT if you have a secondary DNS entry in the IP settings, then the IP stack will flip over to using the secondary DNS listed... and now get a response for Active Directory.
If 127.0.0.1 fails to respond to a DNS request, you have issues that need resolved. Dont mask it.
then there is never a reason to give a client a secondary DNS either - don't mask that problem.
-
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
You are mixing things, just fucking stop.
This discussion is strictly related to DNS server functionality. Client connectivity is unrelated.
Of course DC1 needs a reference to DC2 in its own DNS tables, because it is all replicated and all systems know all. This also has nothing to do with NIC DNS settings..
NIC DNS settings are strictly for the DNS client service on a system to access..
He's talking about the client service
-
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
Correct - that's how the client works.
But the server is also a client. Active Directory needs to make a DNS call - so it looks to the IP stack and gets the primary DNS server IP - which fails to respond. If there is no secondary DNS server, the AD service on this server now fails. BUT if you have a secondary DNS entry in the IP settings, then the IP stack will flip over to using the secondary DNS listed... and now get a response for Active Directory.
If 127.0.0.1 fails to respond to a DNS request, you have issues that need resolved. Dont mask it.
then there is never a reason to give a client a secondary DNS either - don't mask that problem.
It's failover. I think what JB means is that if you have a problem you should know you have a problem
-
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
You are mixing things, just fucking stop.
This discussion is strictly related to DNS server functionality. Client connectivity is unrelated.
Of course DC1 needs a reference to DC2 in its own DNS tables, because it is all replicated and all systems know all. This also has nothing to do with NIC DNS settings..
NIC DNS settings are strictly for the DNS client service on a system to access..
OMFG - I've been very specific that it's about the DNS client service - go back and read.
Read that again, I know exactly what you are talking about. It is @wirestyle22 that was confused
-
@wirestyle22 said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
You are mixing things, just fucking stop.
This discussion is strictly related to DNS server functionality. Client connectivity is unrelated.
Of course DC1 needs a reference to DC2 in its own DNS tables, because it is all replicated and all systems know all. This also has nothing to do with NIC DNS settings..
NIC DNS settings are strictly for the DNS client service on a system to access..
He's talking about the client service
of course I am - the client service is the ONLY place you have secondary DNS. In the IP stack info. In an AD/DNS integrated setup, you don't don't have secondary DNS servers, they are all equal. Just like Domain Controllers are all equal (save for RODCs)
-
@wirestyle22 said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
Correct - that's how the client works.
But the server is also a client. Active Directory needs to make a DNS call - so it looks to the IP stack and gets the primary DNS server IP - which fails to respond. If there is no secondary DNS server, the AD service on this server now fails. BUT if you have a secondary DNS entry in the IP settings, then the IP stack will flip over to using the secondary DNS listed... and now get a response for Active Directory.
If 127.0.0.1 fails to respond to a DNS request, you have issues that need resolved. Dont mask it.
then there is never a reason to give a client a secondary DNS either - don't mask that problem.
It's failover. I think what JB means is that if you have a problem you should know you have a problem
Sure, that's fine - but at the expense of the users working? Yeah I disagree.
-
@Dashrender said in DNS Update Issue:
@JaredBusch said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
@wirestyle22 said in DNS Update Issue:
@Dashrender A computer is making a request of DC1. DC1's dns service has failed. computer receives no response and moves to DC2 (the second dns entry). This is what I am referring to. Why would DC1 need to reference DC2 in it's own DNS entries? The replication is something else entirely and doesnt rely on the dns service. Am I missing something? If the DNS service fails it's just a failure regardless of other entries.
Correct - that's how the client works.
But the server is also a client. Active Directory needs to make a DNS call - so it looks to the IP stack and gets the primary DNS server IP - which fails to respond. If there is no secondary DNS server, the AD service on this server now fails. BUT if you have a secondary DNS entry in the IP settings, then the IP stack will flip over to using the secondary DNS listed... and now get a response for Active Directory.
If 127.0.0.1 fails to respond to a DNS request, you have issues that need resolved. Dont mask it.
then there is never a reason to give a client a secondary DNS either - don't mask that problem.
Incorrect, because a client system is not a DNS server. You don’t setup a client and a server the same.
