Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows DC that is "freezing" every day and has to be rebooted (VM) in order to even login. Going through the System logs I see several errors with the following;

The dynamic registration of the DNS record ' 
600 IN SRV 0 100 389' failed on the following DNS server:  

DNS server IP address: 
Returned Response Code (RCODE): 5 
Returned Status Code: 9017  

For computers and users to locate this domain controller, this record must be 
registered in DNS.  

Determine what might have caused this failure, resolve the problem, and 
initiate registration of the DNS records by the domain controller. To 
determine what might have caused this failure, run DCDiag.exe. To learn more 
about DCDiag.exe, see Help and Support Center. To initiate registration of 
the DNS records by this domain  controller, run 'nltest.exe /dsregdns' from 
the command prompt on the domain controller or restart Net Logon service. 

Or, you can manually add this record to DNS, but it is not recommended.  

Error Value: DNS bad key.

The IP address resolves to which is obviously outside our local network and belongs to our ISP. Can anyone provide some tips on how to exclude this IP address from being registered by DNS? I'm not sure that this is causing the "freezing" issue, but it seems like a good place to start.

Thanks in advance for the help.

share|improve this question

How's your DC's DNS configured?

It's attempting a dynamic update against the server that it believes to be authoritative for the domain.

If it's pointing to an internet DNS resolver, it'd be right; that server is indeed marked as authoritative in your domain's SOA record:  7200  IN  SOA 2005110926 83000 10000 604800 86400

Now, while this is correct for the internet-facing version of your domain, you can bet that your domain controllers think they ought to be authoritative instead for the internal version of your zone.

Your domain controller should have outside DNS servers configured as forwarders in the settings for the DNS service, but in the DNS settings for the NIC, it should be pointing to itself ( and other domain controllers only; this is likely the problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.