Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows Server 2008 AD Integrated DNS zone across two domain controllers, I have added various CNAMEs pointing to our Build and Dev Web servers to support or continuous integration process.

These CNAME, and the A record for a server vanish over night, not all of them just a small selection usually between 5 and 7 days after they were created.

  • No one else in the company has touched the config (only 2 of us have access, I have primary responsibility for managing DNS).
  • DNS Scavenging is disabled on both DNS servers.
  • There are no error messages or warnings in the Event Logs.

Any ideas, suggestions or solutions appreciated.

share|improve this question
Sounds like a replication issue. Do you have any issues when forcing replication? – Nixphoe Apr 14 '11 at 12:20
DNS scavenging has no effect on manually created DNS records unless you manually set the "Delete this record when it becomes stale" check box when you create the record. – joeqwerty Apr 14 '11 at 12:41
@Nixphoe no issue with replication, automatic or manual. The changes appear on both DNS servers promptly and vanish simultaneously overnight. – Richard Slater Apr 14 '11 at 14:22
@joeqwerty good to know, however I don't have that check box only TextBox for Name, Text Box for FQDN and a Check Box for "Allow any authenticated user to update all DNS..." – Richard Slater Apr 14 '11 at 14:38
up vote 1 down vote accepted

I'd still suspect scavenging, personally; those settings have a habit of not working right. The per-zone settings and per-server settings combine to make for some strange behavior.

But, we don't have to guess at what's going on. Turn on the Directory Service Changes security audit category on your domain controllers; more info on how to do this here.

You will then get events in your security log (specifically, 5136 for changes or 5141 for deletions) that communicate exactly who, what, and when the entries were messed with.

share|improve this answer
Thanks, I have enabled auditing - we shall see what shows up. – Richard Slater Apr 14 '11 at 15:24

It sounds like you have a duplicate DNS zone.

Use the following resources to check:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.