I have a small network with a Win SBS 2k3 (SP1) domain... how do I set it up so that the workstations (they're all DHCP clients) can still resolve domain names if the domain server is down (without messing up any Windows domain stuff)?
You can supply multiple DNS entries in DHCP. You could provide the public DNS in that list.
BUT, i don't think this will work as well as you might think. The correct way to do this is to have a backup DNS server for your LAN.
The reason it may not work properly is that even when your SBS DNS is running, clients may get a errors resolving hostnames for local machines because they queried an external DNS.
I found this trouble at my ex workplace. Why it didn't work for me is because the local DNS name was the same as the external DNS domain name. So, sometimes we get results and sometimes not. I originally didn't set this up but discovered it. Once I removed the extra entry and put in a backup DNS, I had things working better. The other problem I had, although not entirely sure it was related was queries seemed to take a long time. I'm not really sure if MS windows issues DNS queries in parallel or in sequence to each server. If it's in sequence and the primary DNS is down you might get a long timeout.
So I think it could work, but it's far better to use a backup DNS. (EDIT: That is, a Microsoft Backup DNS server, not just any server!. This doesn't need to be a powerful machine. It can be dedicated to just backing up DNS).
I'm not saying, don't try it, just don't expect smooth sailing with this method.
I'll do the short answer, then,
If the domain controller is down, and the domain controller is also acting as the DNS server for the LAN, then there's no other way to do DNS lookups without "messing up the Windows domain stuff". The "Windows domain stuff" is heavily reliant upon the DNS. Have multiple domain controllers, all with the DNS server rôle and AD-integrated zones, if the server going down is a major concern.
Don't use the proxy DNS servers that your ISP provides as "backups". It's both wrong in principle and broken in practice. For starters, the list of DNS servers that a workstation is configured with is not a priority ordered list. Workstations can choose to query proxy DNS servers in various orders, subject to whim and a range of DNS client library bugs.
- Jonathan de Boyne Pollard (2003). Your fallback proxy DNS servers must provide the same view of the DNS namespace as your principal one.. Frequently Given Answers.
This has caused issues for the network I support -- using a public DNS. I didn't have direct control over those DNS servers and occasionally the domain clients wouldn't resolve the domain name right. As a result, I would get group policy errors (because it would randomly use the public DNS).
It sounds better to set up the AD DNS to do forwarding to the public DNS and have domain clients only use AD DNS servers (or servers properly configured for it)