I'm setting up several child domains in an existing Active Directory forest and I'm looking for some conventional wisdom/best practice guidance for configuring both DNS client settings on the child domain controllers and for the DNS zone replication scope.

Assuming a single domain controller in each domain and assuming that each DC is also the DNS server for the domain (for simplicity's sake) should the child domain controller point to itself for DNS only or should it point to some combination (primary VS. secondary) of itself and the DNS server in the parent or root domain? If a parent>child>grandchild domain hierarchy exists (with a contiguous DNS namespace) how should DNS be configured on the grandchild DC?

Regarding the DNS zone replication scope, if storing each domain's DNS zone on all DNS servers in the domain then I'm assuming a DNS delegation from the parent to the child needs to exist and that a forwarder from the child to the parent needs to exist. With a parent>child>grandchild domain hierarchy then does each child forward to the direct parent for the direct parent's zone or to the root zone? Does the delegation occur at the direct parent zone or from the root zone?

If storing all DNS zones on all DNS servers in the forest does it make the above questions regarding the replication scope moot? Does the replication scope have some bearing on the DNS client settings on each DC?

  • 1
    If you have a single domain controller using only itself for DNS you can run into problems with boot times of 5-10 minutes while it waits for DNS that isn't there. There doesn't seem to be any better solution than having another DNS server up and ready at DC boot time. I'm fairly certain it can be any old DNS server for boot time purposes, but obviously you want something that is going to be an appropriate choice for a DC... which may be where your other replication and delegation questions come in. I'm interested to hear from someone who knows a bit more in that area.
    – hwilbanks
    Nov 7 '12 at 20:22

I'd rather go with a single domain using your two servers for redundancy than to use two separate domains on single (point of failure) servers. What is driving your choice to go with a parent/child domain forest? You could just use the DNS space for the child domain since you said it's contiguous without requiring an AD domain unless you have security boundary concerns.

Against my better judgement, I'll answer the question assuming you have two servers for each domain (four total) -- just subtract two of the servers for your case.

Option 1.

With your desire to keep DNS local to the domain, the parent DCs point to one another and the child DCs point to one another as well. The easier configuration would be to use a scope that replicates the DNS zone forest-wide.

You have parent.local (or whatever) as your top-level and child.parent.local as the subdomain.

AD will replicate both domains throughout the forest making DNS resolution simple. You'll see overlap on a given DNS server with the zones, but Windows deals with that.

Option 2.

Another option is to not do forest-wide replication in which case I would simply configure a forwarder on the child DCs to send everything up to the parent DCs DNS, but on the parent you'll need to create a delegation for the child subdomain back down.

  • I believe option 2 is the default configuration, at least for a new 2008 R2 forest.
    – hwilbanks
    Nov 14 '12 at 16:57

Honestly, to provide a "best real-world practices" answer, I think you need to add one more piece of info. Where are all the dcs/ DNS controllers going to be physically located? If the children are at separate physical sites, you want each to have their own child domain stored locally and not in the forest. Best practice calls for an empty forest. DNS servers should always point to themselves first and then use a forwarder t point up to its parent (or the forest). An easy way around the slow boot issue is to add itself to the local hosts file (although I seem to also remember a reg fix for this).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.