How do I configure Windows AD to use an external DNS server? We have a tool for managing DNS. We're attempting to use Windows AD for authentication. In order to get a server to join the domain, we must point it to the AD server as DNS. However, in so doing, the server that is pointed to the AD server for DNS can no longer resolve hostnames in our environment.

We're using example.com for our login domain across the environment. All of our servers are servername.subdomain.example.com.

When I join servername1.subdomain.example.com to the domain it can no longer resolve servername2.subdomain.example.com, unless I manually add the DNS entry for servername2.subdomain.example.com do the DNS on the AD server.

We don't want to have to create two DNS entries for everything so we need the AD server to look at the external DNS server for DNS.

I attempted to create a Forward Lookup Stub zone for subdomain.example.com but when I get to the "Specify the DNS servers from which you want to load the zone" and enter my dns server I get an error when attempting to validate: "An unknown error occurred"

Attempting to add a new delegation under my existing example.com domain is bet with the same error when adding DNS servers.

Admittedly, I'm not a Windows Admin and my understanding of AD is superficial at best, but it seems like what I'm asking for should be relatively simple... I'm just looking for a recursive lookup on hostnames from the domain controller.

Any pointers in the right direction are greatly appreciated.

  • Do you have anything configured in DNS Management, in the properties of the DNS server, in the 'forwarders' tab? That should have your upstream DNS servers - kb.k12usa.com/Uploads/Images/Win2003%20-%20DNS%20Forwarders.gif (I'm not entirely sure if this is what you're asking, but it's a quick thing to check) Oct 6 '15 at 17:10
  • I don't understand the question. What is your AD DNS name? Where are the DNS servers that host the AD DNS zone?
    – joeqwerty
    Oct 6 '15 at 17:21

However, in so doing, the server that is pointed to the AD server for DNS can no longer resolve hostnames in our environment.

If that's the problem, why not set up a forwarder in AD to your desired DNS server? Open the DNS mmc snap-in on your AD server, right click on the server name (not the zone or any of the folders) and choose "Properties". This will open a dialog window that include a tab labeled "Forwarders" where you can add the IP address of your desired DNS server and set the lookup order.


For AD to be able to operate it depends on DNS system. There are several records which is changing in time or with specific event. These records are practically not possible (or very hard) to maintain out of the AD. That is the reason why with "default click, click" installation the AD start acting as DNS server and to have it working you have to point to these DNS (AD member/-s/). Once you want to use the same domain also for other purpose you can select one of following scenario (it is selected with AD provisioning / new AD domain set up).

  • keep DNS records for the domain on AD's DNS and forward request on it

  • keep DNS records on external DNS but AD has to be configured to use external DNS server and AD has to be allowed for dynamic updates for the zones on the external sources

Practically it is not possible to have the domain and external DNS server and also keep "thinking" AD as to be master for the domain. In that case the zone would be inconsistent based on where you are asking - all DNS server think that they know all but has only part of the information...

Not working scenario

You have working DNS for example.com (so far without AD). You make decision to use AD on the same DNS zone (example.com) and do "default click" instalation (let assume that AD is not able to check existence of the domain during the installation).

  • orginal DNS server has no idea about AD

  • AD think that is maintainig the DNS zone and it has no idea about the rest of example.com domain

    • once you donnect any PC / server to domain - you will lock it to "AD view" as otherwise it will have no information about AD

    • any DNS record generated / created in AD is not automatically propagated to "main" DNS for example.com

Working scenario A

You have working DNS for example.com (so far without AD). You make decision to use AD on the same DNS zone (example.com). Let say you are going to install AD on

  • (before AD install) on current DNS server allow dynamic updates for example..com zone for the (IP of newly installed AD server)

  • AD will push all necessary DNS structure to external DNS server and it will maintain it in time (you will see several dynamic updates in time ;-) ).

  • everything will be done transparent to the current DNS zones. You don't need to point the systems to other then current DNS servers as the changes will be done on it / them directly by AD

Optionally In case you would like to have it separated you can prepare the "service subdomains" as extra zone (here I am not going deeper to keep it even long but not so technical so complex ;-) ). In case you would like to realize it is good idea to do it before installation of AD or you can freeze the zone and manually move to separate zone file - subdomain.

Working scenario B

You have working DNS for example.com. You make decision to use AD on the subdomain of DNS zone (subdomain.example.com). Let say you are going to install AD on

  • the AD will act as dns server for subdomain.example.com.

    • in case example.com is "official" publicly available / known (and your !) domain, you are done on AD side

    • in case you are using just some local domain, once AD is setup, you need to add forward zone for example.com (the highest local zone you are using - the lower one will be resolved using "regular" DNS operation) to point out to your current DNS server as it is not resolvable "officialy" via .com nameservers (in case of example.com).

  • on current DNS server (in this case handling example.com) you need to add the delegation record for the subdomain to know where to look for it (newly added AD)

    subdomain.example.com. IN NS ad1.subdomain.example.com.
    ad1.subdomain.example.com. IN A
  • once you set up AD on any domian, you cannot forward this domain to other DNS server just defining forward zone - AD's DNS system will not allow you to set it up the way AD would not have control over DNS zone it is using.
    – Kamil J
    Dec 7 '18 at 12:49
  • It is true that there is a bunch of records yes, but there is no need for it to be able to update them, it makes life easier sure, but also less secure. The exact records needed is what should be provided.
    – NiKiZe
    Nov 12 '20 at 9:45
  • In case you want high level of security and keep working AD you should keep DNS on AD's server. The update handled via AD replication has some security level. DNS level of updates is not secure on Windows system - you can only limit source for updates related to AD as the TSIG is not implemented in Windows DNS service. But to keep it working you should allow AD to make update as the records are dynamic in principle. Sure it will work in case of static setting but it may stop working at any time.
    – Kamil J
    Nov 12 '20 at 10:57
  • I would never expose a windows DNS instance to the internet, I would not trust it, there are many other services that is more suitable, but requires manual update of DNS records, but that is only once per time you change/add/remove servers or their IP or name. Nothing will magically just break.
    – NiKiZe
    Nov 12 '20 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.