Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two domain controllers with DNS/DHCP enabled on both. Both are Windows 2008 R2 (migrated from Windows 2003 a while back). Best practices analyzer seems to be showing couple of errors I can't figure out. Both controllers are Virtual Machines with 1 NIC only. First AD is, secondary is

  1. DNS servers on <interface> should include the loopback address, but not as the first entry.I have added as 3rd dns server to the interface that the problem occurs on, but still BPA complains. Any thoughts why?

  2. Zone PRIVATEZONE secondary servers must respond to queries for the zone. It seems to me DNS/AD server works fine on secondary controller. I can nslookup to it from first AD controller and check external and internal names. Why it's complaining then ?

  3. The DNS server on <interface> must resolve names in the forest root domain name zone. This shows multiple times for and as well (since it's added). Not sure what could be the problem, everything seems fine?

  4. The DNS server on <interface> must resolve names in the primary DNS domain zone

  5. Warning: Zone PRIVATEZONE secondary server should respond to queries for the zone. Same stuff appears for

DCDIAG shows everything is ok.

repadmin /showrepl <controler2> shows everything is good.

share|improve this question
up vote 1 down vote accepted

After reading some of the BPA stuff, BPA is possibly complaining too much.

  1. According to the doc, "The loopback address should be configured only as a secondary or tertiary DNS server on a domain controller." You've done this. False fail.
  2. This step checks the list of servers on the "Zone Transfers" tab and checks those. Verify THAT lists only valid secondaries. Remove any that don't belong.
  3. The failure here is, "A DNS server that is configured on the network adapter was unable to resolve the start of authority (SOA) record for the forest root domain name." If you're using NSLOOKUP, set your type to SOA (set type=SOA) and see if you can get the forest root. If all of the DNS servers on your tabs will resolve the SOA record, this is a false fail.
  4. This is the same as the previous point, but with a different DNS domain.
  5. This checks the DNS servers listed in the Zone Transfers tab for ability to resolve the primary zones. If point 2 failed, this is likely to fail too.

The Best Practices Analyzer documentation for Server 2008R2 is located here:

Why is it doing the false-fails? I couldn't tell you. If you've verified that it works using manual methods, it's time to contact Microsoft.

share|improve this answer
I was suggested that IPv6 might be the issue. So i've disabled iPV6 totally (as we don't use it). And going to check after reboot (need to wait 30 minutes more before doing so). – MadBoy Feb 8 '11 at 17:12
@MadBoy Not a bad guess! – sysadmin1138 Feb 8 '11 at 17:13
For #1, it wants Server A to have the Primary DNS as Server B and the Secondary DNS as the loopback address, and the reverse setup on Server B. (I suspect you have the primary set to the 192.168.1.X address of the server.) – Clint Feb 8 '11 at 17:32
@Clint, i've changed it as you said on AD1 -> IP2, LOCAL, IP1 and on AD2 -> IP1, LOCAL, IP2 and it removed the first complain. A lot more to go. – MadBoy Feb 8 '11 at 18:04
Unfortunetly Ipv6 disabling didn't fix anything... – MadBoy Feb 8 '11 at 18:04

All errors have disappeared when I renamed domain from single domain name (companypl) to For now it was just a test but in few days perm rename will be done.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.