We have 2 hardware interfaces on our Active Directory Domain Controllers. The secondary interface should never be listed in our domain's DNS zone, but it is. This is problematic because most machines on the network do not have access to the secondary subnet that the DCs are on.

For example, our primary subnet is, the secondary network is When clients on the primary network query our AD DNS servers for the DC address, they often get as a result. Clients aren't on that subnet, so everything breaks.

I've tried every combination of advanced DNS settings on the secondary interface on both machines and yet, the secondary IP always ends up being published in the domain DNS zone. I've unchecked "register this connection's address in DNS" with no success. I've left that checked and set a different DNS suffix for the connection (for a different, working zone) along with checking the "Use this connection's DNS suffix in DNS registration" box to no avail. Of course, I always delete the incorrect DNS listing before trying these settings.

Any ideas would be appreciated!

  • 1
    Have you removed the secondary interface from the list of adresses the DNS Server binds to? Jan 7, 2014 at 14:10
  • ^ - that...if it's a DC it is probably running the DNS role. So you'll need to do like @MathiasR.Jessen says.
    – TheCleaner
    Jan 7, 2014 at 14:12
  • The secondary interface is bound because I have another DNS zone that I want served to the secondary subnet. Is that possible without messing up the primary zone? For example, the primary zone is xyz.org which serves the primary subnet. The second zone is san-xyz.org, for the secondary subnet. Bad idea?
    – bluesmoke
    Jan 7, 2014 at 14:23
  • I'm using a secondary interface for storage network and iscsi connector. Apr 11, 2014 at 6:37

3 Answers 3


More than one network adapter is not recommended on domain controllers.

Routers should do routing not domain controllers :)

Although there are workarounds I think all of them are only causing more trouble when You forget about them later and want to revert back.

Usefull links:

or just google search for multihomed domain controllers. You will always get same answer: - not recommended / causing troubles / but possible.


Try to change the registry key of NIC to disable dynamic update.
How-to: http://technet.microsoft.com/en-us/library/cc959739.aspx
You can find GUID of your adapter in Powershell: Get-NetAdapter|Select Name,*GUID

  • Thanks for the advice, I decided to disable the interface and deal with the secondary subnet elsewhere.
    – bluesmoke
    Jan 7, 2014 at 17:19

The server doesn't need an interface and ip address on every subnet in order to host DNS zones for hosts in those subnets. In fact, there's no direct relation between DNS zones and ip subnets.

The server can host DNS zones for any zone that has hosts on any subnet as long as all of the hosts can reach the DNS server. Can hosts on the subnet reach the subnet? If so, then remove the second NIC from the DC and configure all of your hosts to use the DC's 10.10.10.x ip address for DNS.

  • Good points but I want to keep the two subnets entirely isolated.
    – bluesmoke
    Jan 7, 2014 at 17:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .