Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to setup an Active Directory forest that uses a Linux BIND server for DNS. The goal is that the Domain Controller (DC) to be able to make entries in the /etc/bind/ file from the linux server.

Here is a diagram with my current setup and specs:

enter image description here

WinServer DC: Linux DNS:

My current Linux server configuration:

On the DC I have setup a new AD forest and in the IP configurations I have set the IP of the linux server as DNS. But now the problem is that I don't see any new entries in the file that I described above ( and I don't know what further steps I need to take to make this work.

What works so far: In the Windows Server I can open up a browser and browse any website using that linux dns server.

Every feedback is appreciated.

share|improve this question
Hope this link can help a little :… Mainly section regarding DNS SRV type records – krisFR Dec 15 '13 at 13:54
Use nltest /dsregdns or restart netlogon on dc and take a network trace to see what happens to dynamic dns packets and the return codes from bind. Then I expect bind folk here can help more. – maweeras Dec 16 '13 at 17:52
It can be done (I haven't done it myself but have seen it) however, this is not a very good setup since AD is SO dependent on DNS. Is there a reason you need to use bind instead of MS DNS? – Zypher Dec 16 '13 at 23:46
Have you configured dynamic registration of records by the DCs in BIND for both and – MDMarra Jan 28 '14 at 17:25
Check this link:… – Diego Queiroz Jan 20 '15 at 12:25

The two main strategies I've dealt with are delegation and forwarding.

With delegation, you configure BIND as a slave to the AD server, offloading the query load to the BIND server. As long as AD is still the SOA (ala ADI), then any dynamic updates will still be sent to the AD box. You can still configure other zones on the BIND server, however you can run into some issues with multiple views that I've sorted out in the past by adding conditional forwarders to the AD boxes.

With forwarding, you configure your BIND server to forward requests to the AD boxes, allowing you to point your clients at the BIND boxes so they can do the fetching and caching for non-AD requests, but this does very little to offload any of the client load from the AD boxes.

It rather depends on what your goals and resources are as to what is better for your environment. What is very important is maintaining a single source-of-truth for the zone. This is more difficult when running BIND in front of ADI zones due to how the various AD boxes keep their SOA records and serial numbers but if you're only running one ADC, then it's not even a concern.

share|improve this answer

The way I read your question is that you're trying to avoid having the AD domain controller host DNS at all. And that's a perfectly valid configuration.

You basically have two options.

  1. Configure BIND to allow the DCs to perform dynamic updates
  2. Manually populate the DCs' DNS entries into BIND after a DC is promoted

Option 1 is the most common. And the ways you can configure BIND for this range from simple IP whitelists to more complex TSIG setups. But once it's done, you're golden. There are plenty of guides out there on configuring BIND for DDNS. If you need specific help on this, you might want to create a separate question.

Option 2 is "easier" on the BIND config side, but a little more work when promoting a DC. There is a file that gets created on the DC after promotion that contains all of the BIND entries you need to add for that DC. %SYSTEMROOT%\system32\config\netlogon.dns All you really need to do is manually add those entries to your BIND server. However, you will also need to update those entries any time you make AD topology or FSMO role changes (add/remove a site, add/remove a domain, etc).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.