5

I currently am running a single DNS server.

If I don't set a Preferred/Alternate DNS server on the Ethernet controller and run the Best Practices Analyzer I get the following results:

Image1

If I do set the Preferred DNS server to the IP address of the server:

Image2

then I get the following results when running the BPA:

Image3

If I set the Preferred DNS server to a Google Public DNS server and the Alternate DNS server to the local DNS server:

Image4

then I get the following results when I run the BPA:

Image5

How should I have this configured to make the BPA happy?

7

It looks like you've installed the DNS role as part of a Domain Controller installation. The second BPA warning is a little misleading. What it's telling you is that the loopback address should be added as a DNS server, but not as the preferred DNS server. What that means is that you don't have the loopback address added but the warning makes it seem as if the BPA is telling you that the loopback address is added as the preferred address. What you need to do is to access the TCP/IPv4 properties of the NIC and add the loopback address as the secondary server. That should clear the BPA of that error. Leave the current ip address configured as the preferred DNS server.

It's recommended that you install at least two Domain Controllers in every domain. If you add a second Domain Controller then you'll want to change the preferred DNS server on both Domain Controllers to point at their "partner".

So, DC1 points to DC2 as preferred and itself as secondary (with the loopback address added as tertiary), while DC2 points to DC1 for preferred and itself as secondary (with the loopback address added as tertiary).

6
  • That is correct the DNS role is on a Domain Controller. So, if I understand you coreectly, you are saying that this is what my my TCP/IPv4 properties should look like? – Linger Feb 22 '15 at 21:24
  • If you only have this one Domain Controller then yes. If you add a second Domain Controller then see my answer for the proper configuration of the two. – joeqwerty Feb 22 '15 at 21:25
  • As far as the secondary DC is concerned, I only have two other physical servers. One I use as a RDS server. The other is a database server. Could/should I make either of these a DC? – Linger Feb 22 '15 at 21:26
  • IMO, I wouldn't make either one a DC. The Domain Controller role is a role that shouldn't be installed on RDS servers, database servers, email servers, etc., etc. There are a few roles that typically get installed on Domain Controllers (such as the DHCP role) but not roles that directly offer services (RDS, SQL, File) to users. – joeqwerty Feb 22 '15 at 21:30
  • Well currently my Domain controller is also a file server and a dhcp server. So, I already went against that one. How about a DC as a hyper-v machine? – Linger Feb 22 '15 at 21:34
2

The second error message BPA reports state:

DNS servers on Ethernet should include the loopback address, but not as the first entry

The IP address of the server (192.168.22.16) is not the same as the loopback address.

To silence BPA you'll need to configure the "preferred DNS server" with the IP address of another DNS server in your network, and then the secondary DNS server pointing to the loopback address (127.0.0.1).

As explained by joequerty, one of the first best practise steps to take is to deploy at least two DC/DNS servers, which is why the BPA expects you to cross-ref their addresses for DNS resolution.

3
  • Not necessarily. If the OP only has one DC/DNS server (not recommended) then it should point to itself as preferred and the loopback as secondary. If he has another DC/DNS server then each DC/DNS server should point at it's partner for preferred, itself as secondary and the loopback address as tertiary. – joeqwerty Feb 22 '15 at 21:18
  • There still seems to be conflicting information as to what MS considers best practice for Domain Controllers regarding their DNS client settings. I'm fairly certain that my answer (and my comment to your answer) is considered current best practice. – joeqwerty Feb 22 '15 at 21:21
  • @joeqwerty True, but I'm trying to answer his question: how to make BPA happy - not how to "cheat" BPA. – Mathias R. Jessen Feb 22 '15 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.