Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Right now, I have three forests I'm trying to create trusts between.

Let's call them hopelessn00b.local, and

I got trusts configured between hopelessn00b.local and, as well as between hopelessn00b.local and, but when I went to set up the trust between and, it bombed out, because cannot contact

So, I checked DNS, and sure enough, there's no forwarders or stub zones or anything that might tell how to get to I checked my hopelessn00b.local forest, and it was using a conditional forwarder to reach both the other domains, so I tried to set up a conditional forwarder on with the IPs of my domain controllers. That fails with a "zone configuration error," after telling me that my domain controllers are not authoritative for the domain (they are). I assume that's because is a DNS sub-domain of, even though they're completely different and unrelated AD forests.

Functional levels involved are 2008 R2 and 2012, if it makes a difference (but I don't think it does), and I'd very much like to get these trusts set up so that I can migrate everything off these improperly named forests and then blow them away, so only will remain.

Accordingly, my questions are:

  1. Is a conditional forwarder the thing I want here, or should I be using something else? (Stub zone, maybe?)
  2. How do I force (or finesse) into taking my word for it that the DCs for are actually authoritative for
share|improve this question
Delegate, you must... – Ryan Ries Feb 3 '14 at 14:15
@RyanRies But there are no child domains at play here, nor do I wish there to be. I don't want the best-practices-compliant AD forest to become dependent on the soon-to-be-obliterated AD forest. Is a delegation still applicable in this case? – HopelessN00b Feb 3 '14 at 14:32
@HopelessN00b: Ryan is correct, you need to dns delegate. Even if there as you say is no AD child domain, there is in dns by way of namespace. On the bright side, when you have obliterated to your hearts content you could simply remove the delegation and refer/forward dns clients directly to the (not-)child domain. Sorry, can't work out how to phrase that last bit, I hope you understand my intention :-) – ErikE Feb 3 '14 at 15:02
up vote 4 down vote accepted

Since the two domains, even though they are in unrelated AD forests, are part of the same DNS namespace, you must use DNS delegation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.