I have a small network with a Win SBS 2k3 (SP1) domain... how do I set it up so that the workstations (they're all DHCP clients) can still resolve domain names if the domain server is down (without messing up any Windows domain stuff)?

  • 3
    The short answer: You shouldn't. – joeqwerty Jan 11 '12 at 11:47
  • 2
    Add a backup domain controller. – Jeff Ferland Jan 20 '12 at 16:57

You can supply multiple DNS entries in DHCP. You could provide the public DNS in that list.

BUT, i don't think this will work as well as you might think. The correct way to do this is to have a backup DNS server for your LAN.

The reason it may not work properly is that even when your SBS DNS is running, clients may get a errors resolving hostnames for local machines because they queried an external DNS.

I found this trouble at my ex workplace. Why it didn't work for me is because the local DNS name was the same as the external DNS domain name. So, sometimes we get results and sometimes not. I originally didn't set this up but discovered it. Once I removed the extra entry and put in a backup DNS, I had things working better. The other problem I had, although not entirely sure it was related was queries seemed to take a long time. I'm not really sure if MS windows issues DNS queries in parallel or in sequence to each server. If it's in sequence and the primary DNS is down you might get a long timeout.

So I think it could work, but it's far better to use a backup DNS. (EDIT: That is, a Microsoft Backup DNS server, not just any server!. This doesn't need to be a powerful machine. It can be dedicated to just backing up DNS).

I'm not saying, don't try it, just don't expect smooth sailing with this method.

  • 4
    An AD member should NEVER have a non-AD DNS server configured. – ThatGraemeGuy Jan 11 '12 at 9:13
  • 2
    @GraemeDonaldson That might need to be phrased better - they shouldn't have a DNS server configured that doesn't have the AD information, but serving AD DNS info from a non-Microsoft DNS server works just fine. – Shane Madden Jan 11 '12 at 21:09
  • Ya, that's what I meant. – ThatGraemeGuy Jan 12 '12 at 7:41
  • I am saying don't try it. It's wrong. – JdeBP Jan 20 '12 at 16:47
  • 2
    LDAP, Kerberos, DNS, and locating things through ordinary SRV resource records is not what most people who know their apples would call "their own way of doing things". – JdeBP Jan 22 '12 at 23:30

You cannot.

I'll do the short answer, then, joeqwerty. ☺

If the domain controller is down, and the domain controller is also acting as the DNS server for the LAN, then there's no other way to do DNS lookups without "messing up the Windows domain stuff". The "Windows domain stuff" is heavily reliant upon the DNS. Have multiple domain controllers, all with the DNS server rôle and AD-integrated zones, if the server going down is a major concern.

Don't use the proxy DNS servers that your ISP provides as "backups". It's both wrong in principle and broken in practice. For starters, the list of DNS servers that a workstation is configured with is not a priority ordered list. Workstations can choose to query proxy DNS servers in various orders, subject to whim and a range of DNS client library bugs.

Further reading


This has caused issues for the network I support -- using a public DNS. I didn't have direct control over those DNS servers and occasionally the domain clients wouldn't resolve the domain name right. As a result, I would get group policy errors (because it would randomly use the public DNS).

It sounds better to set up the AD DNS to do forwarding to the public DNS and have domain clients only use AD DNS servers (or servers properly configured for it)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.