Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

continuing the last question about Windows AD + Linux BIND. I decided to create a subdamain for AD to run on.

It's ad.wxxx.xxxxx. My configuration is okay, but I don't think it does the delegation job right. I have DNS and AD on the same server on xxx.xx.27.15, and the main name server for wxxx.xxxxx is at xxx.xx.26.1.

The problem is that I have configurated a zone for that subdomain, and a NS record and A record for, both pointing to xxx.xx.27.15. I can do nslookup, but I can't join the AD domain with another computer.

When I'm using the full ad.wxxx.xxxxx, the error message says that I don't have delegation for the following subdomain: ad.wxxx.xxxxx, and it cannot find the SRV record for Active Directory Domain Controller (ADDC).

But when I use its NetBIOS (AD), I can succesfully join. What's the problem here?

share|improve this question
What kind of zone did you configure the subdomain as in BIND? – Shane Madden Feb 4 '13 at 6:37
up vote 4 down vote accepted

I suggest configuring an internally facing forwarder zone for ad.wxxx.xxxx instead of trying to handle it as a NS delegation with A record glue. This will forward traffic for the subdomain to the upstream AD server instead of relying on other nameservers to chase the delegation. The answers will still get cached by the BIND server that performs the forwarding.

zone "ad.wxxx.xxxx" in {
    type forward;
    forwarders {;; };

If your BIND nameserver is only used internally, this will suffice. Otherwise if you wish to ensure that outside traffic does not get forwarded to your AD server, you will need to look into how to set up source address based views...and keep in mind that this is not a recommended configuration, as if your BIND server becomes compromised they have a vector on your AD infrastructure.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.