Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 8 down vote favorite
2

Assuming an environment with multiple domain controllers (assume that they all run DNS as well), in what order should the DNS servers be listed in the network adapters for each domain controller? Should 127.0.0.1 be used as the primary DNS server for each domain controller?

share|improve this question

2 Answers

up vote 8 down vote accepted

According to this link and the Windows Server 2008 R2 Best Practices Analyzer, the lookback address should be in the list, but never as the primary DNS server. In certain situations like a topology change, this could break replication and cause a server to be "on an island" as far as replication is concerned.

Say that you have two servers: DC01 (10.1.1.1) and DC02 (10.1.1.2) that are both domain controllers in the same domain and both hold copies of the ADI zones for that domain. They should be configured as follows:

DC01
Primary DNS   10.1.1.2
Secondary DNS 127.0.0.1

DC02
Primary DNS   10.1.1.1
Secondary DNS 127.0.0.1
share|improve this answer
What about an environment with a DC and a DNS server with an ADI zone? Should the DC still be configured as primary to the secondary? – George Jan 29 at 22:57
@George I don't follow what you're asking. Are you asking about an environment with only one domain controller? – MDMarra Jan 29 at 23:03
Yes, that's correct. Sorry, I thought about adding this but thought it might bulk out the question. (Also - for the record I know that a single DC environment isn't an "ideal config") – George Jan 29 at 23:34
1  
In a single DC environment, you should just have the DC use itself with nothing as the secondary. This is to reduce replication problems, but if you only have one DC then there's no replication. But, yeah...don't do that. Have two DCs. – MDMarra Jan 29 at 23:41
Yeah. Not got a "great" environment at the moment, as it were. But as you may have seen from my other question that you answered, expansion is on the way so, new AD domains and time to do things properly evil laugh. Thanks. – George Jan 29 at 23:42
up vote 2 down vote

Never, ever have a DC use itself as Primary DNS.

All sorts of havoc can (and Murphy dictates: will) happen if the AD services become online before the DNS service is live after a reboot. (Or DNS crashes, gets DOSsed, whatever.)
There is also interaction between DHCP (with dynamic DNS updates) and DNS which depends heavily upon DNS working properly.

Always put 127.0.0.1 last. Also: Don't be tempted to use the real LAN ip-address of the server either.
Dynamic DNS updates from DHCP are very sensitive to this.
(127.0.0.1 always exist and can be accessed faster. The real ip-address might not always be available/be busy. In some scenarios the dynamic DNS updates can actually DOS the LAN adapter if there is a high amount of simultaneous DHCP requests combined with sub-par NIC/drivers.)

share|improve this answer
While you're right about pretty much everything and there are a million reasons to have more than one DC, this isn't one of them. This configuration prevents replication problems. If you don't have The need to replicate, you don't need to worry about preventing replication problems. – MDMarra Jun 3 '12 at 0:08
@MDMarra: You are right about replication/DNS interaction... But the original question was a general question and not replication specific. I was more thinking about DHCP-DNS issues. Usually at least one of the DC's also provides DHCP with dynamic DNS updates. All sorts of weirdness may occur if DNS is not properly configured. I will update my answer to clarify that. – Tonny Jun 4 '12 at 8:56
It's actually a security issue if DHCP is deployed on a DC. if its at all possible, it shouldn't be. – MDMarra Jun 4 '12 at 10:05
"Always put 127.0.0.1 last" Can you elaborate more on the reasons behind this? – Bigbio2002 Jun 4 '12 at 23:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.