Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It started as a simple diagnostic: dcdiag /c

when it ran it gave me the following error from the DNS portion of the DCDIAG test

delegation is broken for on dns server on dns server


delegation is broken for on dns server on dns server

Those IP's correspond to the two domain controllers on the network.

So now I am left wondering. What is a broken delegation and more importantly, how do I fix it?

share|improve this question
up vote 2 down vote accepted

The delegation test checks for broken delegations by ensuring that all NS records in the Active Directory domain zone in which the target domain controller resides have corresponding glue A records.


1) Setup DNS servers in TCP/IP config for your servers as folowing: own IP as primary DNS, other DC as secondary DNS (check for details). Never use ISP (or other external) DNS as DNS server at any DC in TCP/IP settings

2) ipconfig /registerDNS on both servers

3) netdiag /fix

share|improve this answer
I tried your suggestion but it did not resolve the problem :(. I suspect there is an issue in how the DNS servers themselves are configured on the PDC and BDC. I am sure it is something fundamentally simple, but for the life of me I dont know what I am missing to resovle the issue. – MikeJ Mar 7 '10 at 16:06

For me, someone had simply added an A HOST record under the wrong place.

IE if your domain was Test.Microsoft.internal, someone had created a sub domain in DNS called "internal", with a sub domain called "microsoft", and within that a sub domain called "Test" - hence you then get [computername] The DCDIAG dns test will then give you the "delegation is broken for ..." error for each and every Name Server for your DNS zone.

E.G. This was in my tree view in DNS:


Took me a while to figure this out, as it's somewhat misleading. Deleting the emboldened domains resolved the error message. Otherwise it wasn't really that important, but the error makes it sound like it is!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.