Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have two separate AD forests that exist within the same subnet. The two forests have independent copies of the reverse lookup zone for that subnet.


Domain A DC1:

Domain A DC2:

Domain A AppServer1:

Domain B DC1:

Domain B DC2:

Domain B Appserver1:

What I'm after, is a configuration that allows this reverse zone to be shared between them so that both sets of DNS servers can make updates to the zone.

This kind of thing is a little far from my everday work, so a kick in the right direction is a welcome suggestion as well. Decoupling one AD into new segments is a possibility I'm open to but would like to avoid if possible. If there is a DNS related solution I'd prefer that.

share|improve this question
Just to clarify this in my mind: Why do you want a single rDNS zone that can be updated and queried by clients in both AD domains? The copy of each rDNS zone is only relevant to clients that use each of the respective DNS servers. I run multiple AD domains at home on the same subnet and the DNS server for each AD domain hosts it's own rDNS zone for the subnet, which is relevant to that DNS server's clients only. Do you have a need to "share" the RDNS zone so that clients using one DNS server can resolve PTR records for hosts that reside in the other rDNS zone? I'm not seeing the need you have. – joeqwerty Sep 13 '12 at 19:25
So my question is, how important are authenticated updates to you? Have you tried permitting un-authenticated updates, and temporarily adjusting the DNS client settings to point at the other set of DNS servers? Are you willing to have that reverse zone be handled by a server separate from both domains perhaps? – Zoredache Sep 13 '12 at 20:26
That's my thinking as well, it's not as important. Basically one AD is an actively changing corporate environment, and one is more of a service environment. I suppose one really only needs/reverse entries for its relevant resources. – SpacemanSpiff Sep 13 '12 at 20:35
up vote 1 down vote accepted

I don't think there's a way for two DNS servers in different forests to do multi-master two-way sync... but maybe there's another way:

This may reduce security but what if you setup one forest as a primary rDNS zone, and the other forest as the secondary rDNS zone. I don't think secondary could be stored in AD so you'd need to setup secondary on each DNS server in second forest.

Then configure both forests' rDNS zone to allow zone transfers and enable notify. Limit to DNS server IP's for security sake.

The snag is what will a client on second forest do? It updates DDNS in it's forest but I'm not sure if client or DNS Service is what updates the rDNS zone. And since I think secondary zone for the rDNS is read-only, then somehow a referral needs to be made to the primary rDNS in first forest. If that actually happened, then I would imagine first forest rDNS would need to be changed from secure updates only to nonsecure and secure. Not as big a deal for rDNS zones, but still.

This is a rare scenario but curious myself if it can be done. Let us know how it goes. I could be totally wrong in my thinking here.

share|improve this answer
This will have to do for now, becuase one environment is fairly static, I'll simply have to add my entries over there and that should be alright. Perhaps next go round we'll use a master forest with two child domains instead but this was kind of a work in progress/design as you go and now we have to live with it. – SpacemanSpiff Sep 17 '12 at 18:28

this is impossilbe. you cannot have 2 rDNS Zones for the same subnet on one server. it would be the same if you wan't to create 2 Forward Zones with the same Domain Name

share|improve this answer
Impossible is a bit strong wouldn't you say? Though it doesn't apply in this case, I can easily have two zones for the same subnet on Bind using views. But that doesn't really matter, since it doesn't sound like he wants two zones, he wants a single zone that, clients from both domains can submit updates to. – Zoredache Sep 13 '12 at 20:22
yes i was wrong on the goal – user1008764 Sep 13 '12 at 20:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.