Right now, I have three forests I'm trying to create trusts between.

Let's call them hopelessn00b.local, hopelessn00b.com and internal.hopelessn00b.com.

I got trusts configured between hopelessn00b.local and hopelessn00b.com, as well as between hopelessn00b.local and internal.hopelessn00b.com, but when I went to set up the trust between hopelessn00b.com and internal.hopelessn00b.com, it bombed out, because hopelessn00b.com cannot contact internal.hopelessn00b.com.

So, I checked DNS, and sure enough, there's no forwarders or stub zones or anything that might tell hopelessn00b.com how to get to internal.hopelessn00b.com. I checked my hopelessn00b.local forest, and it was using a conditional forwarder to reach both the other domains, so I tried to set up a conditional forwarder on hopelessn00b.com with the IPs of my internal.hopelessn00b.com domain controllers. That fails with a "zone configuration error," after telling me that my internal.hopelessn00b.com domain controllers are not authoritative for the internal.hopelessn00b.com domain (they are). I assume that's because internal.hopelessn00b.com is a DNS sub-domain of hopelessn00b.com, even though they're completely different and unrelated AD forests.

Functional levels involved are 2008 R2 and 2012, if it makes a difference (but I don't think it does), and I'd very much like to get these trusts set up so that I can migrate everything off these improperly named forests and then blow them away, so only internal.hopelessn00b.com will remain.

Accordingly, my questions are:

  1. Is a conditional forwarder the thing I want here, or should I be using something else? (Stub zone, maybe?)
  2. How do I force (or finesse) hopelessn00b.com into taking my word for it that the DCs for internal.hopelessn00b.com are actually authoritative for internal.hopelessn00b.com?
  • 1
    Delegate, you must... support.microsoft.com/kb/255248
    – Ryan Ries
    Feb 3, 2014 at 14:15
  • @RyanRies But there are no child domains at play here, nor do I wish there to be. I don't want the best-practices-compliant internal.hopelessn00b.com AD forest to become dependent on the soon-to-be-obliterated hopelessn00b.com AD forest. Is a delegation still applicable in this case? Feb 3, 2014 at 14:32
  • @HopelessN00b: Ryan is correct, you need to dns delegate. Even if there as you say is no AD child domain, there is in dns by way of namespace. On the bright side, when you have obliterated to your hearts content you could simply remove the delegation and refer/forward dns clients directly to the (not-)child domain. Sorry, can't work out how to phrase that last bit, I hope you understand my intention :-)
    – ErikE
    Feb 3, 2014 at 15:02

1 Answer 1


Since the two domains, even though they are in unrelated AD forests, are part of the same DNS namespace, you must use DNS delegation.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.