Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a standard small network setup (20 users) on Active Directory. All Windows machines have a primary DNS server as the AD and a secondary DNS server as Google PDNS. I want to setup a DNS entry that exists in real DNS but set it up on our DC so that local requests would route this public domain to a local development machine on the network.

I setup the zone in DNS which results in the clients resolving the public FQDN to our internal IP. However, sometimes it still resolves to the "real" value (I check by pinging it). Is there some way to give the zone definition in my DC DNS higher priority? Or will the client that has secondary public DNS always at sometimes have a competing entry for this zone?

share|improve this question
up vote 8 down vote accepted

By Google PDNS, I'm assuming you mean one of Google's new "public use" DNS servers. If so then my recommendation would be to remove it as the secondary DNS server for your internal clients. Internal AD\DNS clients should always be configured to use only the internal AD\DNS server(s) for DNS name resolution. You can configure your AD\DNS server(s) to use the Google DNS servers as forwarders if you like, but all internal clients (including the AD\DNS server) should be configured to use the internal DNS server(s) only.

Once you do that, all of your internal clients will look only to the internal AD\DNS server for all name resolution and any zone that the AD\DNS server is authorative for will be answered only by the internal AD\DNS server.

share|improve this answer
+1 - For the easiest life, clients and servers that are members of an Active Directory domain should have only DNS servers specified that are running on domain controller computers. The domain controller computers can have either forwarders or root hints specified to permit external-to-the-forest name resolution. (Yeah, yeah-- if you know what you're doing you can break this rule...) – Evan Anderson Jan 27 '10 at 2:40

Have you flushed the DNS cache for all of the clients? You would also want to flush the server DNS cache (different from the server's resolver cache) by using the DNS console and right clicking the server. However, if it was a server caching issue, I'd expect it to be causing problems with all clients, all the time.

The only reason that your Windows clients will ever check the secondary DNS server is if the first one becomes unavailable, i.e. times out. Are there any availability issues with your DNS server?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.