I've recently started at a new place and I'm wondering the best approach for DNS resolution/replication

It's a single forest (root.local) with 5 child domains (let's call them child1, child2 etc).

Each child domain has a main office with 2 DCs (both running DNS) and several branch offices each with a DC (again running DNS). The big issue is that the connection between the main offices and the branch offices can be slow and somewhat unreliable. Obviously, that goes for the connection from HQ to the branch offices too.

At the moment, the root.local zone is set to replicate to all DNS servers in the forest but I don't see the added value there as I don't think the child domains need to resolve any resources from root.local (to be verified), still that's not SO important and something I can easily change.

For now, just to ensure I can reach any FQDN in the forest, I have set up a stub zone in root.local for each child domain and have populated the DNS Suffix Search list via a GPO. This last bit has been done because, God help me, they were using WINS for NETBIOS name resolution!

My main concern is getting DNS resolution/replication between the branch offices and each main office working as best I can without either the main offices or branch offices having to refer back to root.local for any DNS queries if possible.

As I see it I have a couple options :-

1) Replicate the stub zones to all DNS servers in the forest. This would mean that each DNS Server has a list of all the other DNS servers in the forest. That's an OK solution but will create some amount of replication traffic and, given the network connectivity issues, may not be the best option. It is, however, the least amount of work ;)

2) Create conditional forwarders in each child domain to direct DNS traffic to the appropriate DNS server and have them replicated to each DNS server in the domain. Of course, these will have to be maintained should the DNS servers change in the future but it would, at least, reduce the amount of replication traffic across the entire forest.

Am I missing some more obvious solution?

  • 1
    Don't use .local. RFC 6762 reserves that name for multicast DNS, and by using it you're setting yourself up for weird resolution problems the instant someone adds an iOS, Android, OSX or Linux device to your network. – Calle Dybedahl May 21 '16 at 13:15
  • Are you sweating the small stuff? You mention replication but I think you're talking about resolution, not replication. Is that the case? If you are talking about replication (replication of the DNS zones) have you actually measured the volume of replication traffic? How about replication of AD? The Schema and Configuration partitions are replicated to all DC's in the Forest. Replication of the DNS zones shouldn't be putting any more appreciable load on the connections than the replication of the Schema and Configuration partitions are, which is probably negligible to begin with. – joeqwerty May 21 '16 at 14:41
  • Unfortunately, the .local domains are already there, I've just inherited them. I'd have to get management to approve a domain rename (which I'd love to do). Oh, and yes, I meant resolution not replication ;) – user2745994 May 21 '16 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.