I have a working authorative BIND 9.8.4-P2 server on freebsd on domain domain.com with IP and name ns.domain.com that I did not set up on my own. It is a hidden server from which a subset is published to the providers server.

I have configured an AD ad.domain.com server with DNS under the subdomain corp.domain.com with IP

What works:

nslookup ad.domain.com
nslookup ns.domain.com

nslookup ns.domain.com
nslookup corp.domain.com
nslookup ad.corp.domain.com

What does not work:

nslookup corp.domain.com => nxdomain
nslookup ad.corp.domain.com => nxdomain

I configured it according to this answer, however that does not work.

Here is the excerpt from the zone file (note the SOA line with the providers DNS as the file is published also to our provider):

 $TTL    86400
 @       86400   IN      SOA  ns.provider.com. hostmaster.ns.provider.com. (
                    2015070205      ; Serial number
                    86400           ; Refresh     1 day
                    7200            ; Retry       2 hours
                    604800          ; Expire      7 days
                    259200 )        ; Minimum TTL 3 days

            NS      ns.domain.com.
; secondaries
            NS      ns.provider.com.

; hosts
ns        IN      A
ad        IN      A

I now added the line

corp.domain.com.  IN      NS      ad.domain.com.

at the end but the delegation does not work.

The dig output for dig @ad.domain.com corp.domain.com ns is

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18273
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;corp.domain.com.       IN  NS

corp.domain.com.    3600    IN  NS  ad.corp.domain.com.

ad.corp.domain.com. 1200    IN  A

;; Query time: 0 msec
;; WHEN: Thu Jul  2 09:53:37 2015
;; MSG SIZE  rcvd: 72

while for dig @ns.domain.com corp.domain.com ns it is

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 46841
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;corp.domain.com.       IN  NS

;; Query time: 35 msec
;; WHEN: Thu Jul  2 09:55:20 2015
;; MSG SIZE  rcvd: 39

Looking at this thread, could the issue be that the entry is not in the providers nameserver? I mean, any server in our network asks for dns and with host name updates, the changes are visible immediately on the local network, without pushing them to the provider's DNS.

And just for the record, I also tried this approach with similar results.

Additionally, here is an excerpt from the AD's DNS (not translated)

(identisch mit übergeordnetem Ordner)   Autoritätsursprung (SOA)    [682], ad.corp.domain.com., hostmaster.corp.domain.com.
(identisch mit übergeordnetem Ordner)   Namenserver (NS)    ad.corp.domain.com.
(identisch mit übergeordnetem Ordner)   Host (A)
ad  Host (A) Static

You're specifying a delegation. If you want corp.domain.com to resolve to something, you need (below the delegation):

$ORIGIN corp.domain.com.
    IN  A   some.ip.add.ress
ad  IN  A

and verify that the delegation (NS) is correct in the authoritative server for corp.domain.com



@       86400   IN      SOA  ns.provider.com. hostmaster.ns.provider.com. (

supposed to be

 @       86400   IN      SOA  ns.domain.com. hostmaster.ns.domain.com. (

Also, are you trying to delegate corp.domain.com to ad.domain.com or ad.corp.domain.com?

Lastly, please include the config from the server.

| improve this answer | |
  • When I add that at the end, I see no difference. (I suspect you meant ad instead of as) – martin Jul 3 '15 at 19:43
  • yes, post corrected – Rick Buford Jul 5 '15 at 15:13
  • Yes, the SOA line is strange, but the file is published on our providers DNS and it works like that for host names. I don't know enough about hidden servers to judge whether this does any harm. Actually, I don't know where to delegate to, both ad.domain.com and ad.corp.domain.compoint to the same, I need AD to work, so the second seems reasonable. I updated the question with more information. – martin Jul 6 '15 at 7:01
  • Is this an AD domain, or just DNS? – Rick Buford Jul 6 '15 at 20:24
  • corp is an AD domain, domain.com ist just DNS. That way, I don't need to set the SRV entries or enable dynamic updates, I let that handle the Windows 2012R2 DNS Server – martin Jul 7 '15 at 6:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.