3

I have a small network with a Win SBS 2k3 (SP1) domain... how do I set it up so that the workstations (they're all DHCP clients) can still resolve domain names if the domain server is down (without messing up any Windows domain stuff)?

2
  • 3
    The short answer: You shouldn't.
    – joeqwerty
    Jan 11, 2012 at 11:47
  • 2
    Add a backup domain controller. Jan 20, 2012 at 16:57

3 Answers 3

4

You can supply multiple DNS entries in DHCP. You could provide the public DNS in that list.

BUT, i don't think this will work as well as you might think. The correct way to do this is to have a backup DNS server for your LAN.

The reason it may not work properly is that even when your SBS DNS is running, clients may get a errors resolving hostnames for local machines because they queried an external DNS.

I found this trouble at my ex workplace. Why it didn't work for me is because the local DNS name was the same as the external DNS domain name. So, sometimes we get results and sometimes not. I originally didn't set this up but discovered it. Once I removed the extra entry and put in a backup DNS, I had things working better. The other problem I had, although not entirely sure it was related was queries seemed to take a long time. I'm not really sure if MS windows issues DNS queries in parallel or in sequence to each server. If it's in sequence and the primary DNS is down you might get a long timeout.

So I think it could work, but it's far better to use a backup DNS. (EDIT: That is, a Microsoft Backup DNS server, not just any server!. This doesn't need to be a powerful machine. It can be dedicated to just backing up DNS).

I'm not saying, don't try it, just don't expect smooth sailing with this method.

6
  • 4
    An AD member should NEVER have a non-AD DNS server configured. Jan 11, 2012 at 9:13
  • 2
    @GraemeDonaldson That might need to be phrased better - they shouldn't have a DNS server configured that doesn't have the AD information, but serving AD DNS info from a non-Microsoft DNS server works just fine. Jan 11, 2012 at 21:09
  • Ya, that's what I meant. Jan 12, 2012 at 7:41
  • I am saying don't try it. It's wrong.
    – JdeBP
    Jan 20, 2012 at 16:47
  • 2
    LDAP, Kerberos, DNS, and locating things through ordinary SRV resource records is not what most people who know their apples would call "their own way of doing things".
    – JdeBP
    Jan 22, 2012 at 23:30
2

You cannot.

I'll do the short answer, then, joeqwerty. ☺

If the domain controller is down, and the domain controller is also acting as the DNS server for the LAN, then there's no other way to do DNS lookups without "messing up the Windows domain stuff". The "Windows domain stuff" is heavily reliant upon the DNS. Have multiple domain controllers, all with the DNS server rôle and AD-integrated zones, if the server going down is a major concern.

Don't use the proxy DNS servers that your ISP provides as "backups". It's both wrong in principle and broken in practice. For starters, the list of DNS servers that a workstation is configured with is not a priority ordered list. Workstations can choose to query proxy DNS servers in various orders, subject to whim and a range of DNS client library bugs.

Further reading

0

This has caused issues for the network I support -- using a public DNS. I didn't have direct control over those DNS servers and occasionally the domain clients wouldn't resolve the domain name right. As a result, I would get group policy errors (because it would randomly use the public DNS).

It sounds better to set up the AD DNS to do forwarding to the public DNS and have domain clients only use AD DNS servers (or servers properly configured for it)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .