Active Directory does not work without DNS. When a computer needs to find a domain controller, a user logs on, or Group Policy is applied, the first step is a DNS query. That is why many problems that look like a broken domain are actually a DNS misconfiguration.
What Role Does DNS Play in a Domain?
Every domain controller registers special SRV records in DNS, such as _ldap._tcp.dc._msdcs.example.local for a domain named example.local. Computers query these records to find out where the domain controllers are. If a computer uses an external DNS server, it cannot find these records and effectively loses track of the domain.
Domain DNS zones are usually Active Directory-Integrated. That means they are stored inside Active Directory itself, replicated between domain controllers along with it, and support Secure Dynamic Update.
Correct DNS Settings on Clients and Servers
- Domain-joined computers and servers should have only the domain controllers’ addresses as DNS servers, whether set manually or through DHCP.
- Do not add addresses such as
8.8.8.8or the router’s DNS to clients, not even as a secondary DNS. The computer may use it at an unpredictable moment and fail to find the domain. - On each domain controller, the common recommendation is to set another domain controller as the primary DNS and the server itself as secondary, using
127.0.0.1. - For internet access, configure a Forwarder on the domain DNS servers, pointing to your ISP’s DNS or a reputable public DNS. Clients also resolve internet names through the domain DNS.
If an internet DNS server sits next to the domain DNS in DHCP or in network adapter settings, fix it today. It is one of the most common causes of strange, intermittent problems on domain networks.
Maintenance: Scavenging, Reverse Zone and Conditional Forwarder
- Scavenging: removes records for computers that have been off the network for a long time, so names do not resolve to the wrong address. Enable Aging on the zone and Scavenging on one of the DNS servers, and set the intervals carefully; careless settings can delete records you still need.
- Reverse Lookup Zone: maps IP addresses to names. Many troubleshooting tools and reports rely on it.
- Conditional Forwarder: if you connect to another company’s or branch’s domain over VPN, create a conditional forwarder for that domain name so queries go straight to its DNS servers.
Step-by-Step Troubleshooting
- Run
ipconfig /allon the problem computer to see exactly which DNS addresses it uses. - Use
nslookupto query the domain name and the domain controller name, and see which server answers and with what address. - Use
nltest /dsgetdc:example.localto check that the computer can locate a domain controller. - On the domain controller,
dcdiag /test:dns /vchecks DNS health and the domain records. - If a domain controller’s SRV records are incomplete, restart its Netlogon service so the records are registered again.
- To re-register a computer’s name, run
ipconfig /registerdns; to clear its DNS cache, runipconfig /flushdns.
Common Mistakes
- Adding an internet DNS server on clients or on the domain controller’s network adapter
- Deleting records manually without knowing what they are for
- Decommissioning an old domain controller without removing its records from DNS
- Not having at least two DNS servers for the domain
Checklist
- All clients use only the domain controllers for DNS.
- Zones are AD-Integrated with Secure Dynamic Update.
- An internet Forwarder is configured on the DNS servers.
- Aging and Scavenging are enabled with care.
- dcdiag is run regularly and shows no DNS errors.
ITPlus724 engineers can review your domain DNS settings, fix errors and make sure every client and server is using it correctly.