8

We have a very small (5 workstation) network with one Windows Server acting as domain controller, DHCP and DNS server. All devices are connected to a standard switch which in turn is connected to a standard broadband modem.

The TCP network settings for each workstation are: enter image description here

192.168.0.50 is the IP of the DNS server. 192.168.0.1 is the IP of the modem gateway 8.8.8.8 is Google's public DNS server

Is this a good plan? Is there any point including the modem's IP in that list? I've noticed that the Windows DNS server is receiving and caching requests for public websites. Should the Google DNS server be higher up the list?

| improve this question | |
  • 6
    I had to fix this configuration (remove all but the internal DNS server) on a customer's site once. The symptoms were that occasionally machines couldn't contact the domain controller to log on. Took about 2 minutes to diagnose and fix, and fortunately billing was per hour or part thereof! – Matthew Steeples Apr 24 '17 at 6:46
29

Workstations should have your internal DNS server(s) as the only DNS server(s) in TCP/IP configuration

PCs pick DNS server from the list and stick to it for some time. So if by some chance your workstations would pick your modem or Google DNS server, your internal AD domain name resolution would stop working.

You can optionally have Google or modem's DNS servers specified as forwarders on your DC's DNS Server. But DNS server on DC could also do all external resolution without any forwarders. Using your ISP's DNS servers as forwarders on internal DNS server might make more sense though. But you don't need to use any forwarders at all

| improve this answer | |
  • Ok but what if the internal DNS server was down for some reason, would that stop the workstations accessing public websites? – userSteve Apr 24 '17 at 9:09
  • 4
    @userSteve yes. your task here is to ensure the internal DNS server is sufficiently robust, or have multiple such servers if redundancy is important within your SLA requirement – Cosmic Ossifrage Apr 24 '17 at 10:41
  • 4
    @userSteve your internal DNS server is vital for Active Directory to work correctly (authentication, resource access etc). You are right, in case internal DNS server is down, PCs won't be able to access internet too. But the correct solution is to have 2 or more internal DNS servers. If you would have secondary external DNS server configured on PCs they would stick using it even after your internal DNS server is back online. And here goes the problem - your users wouldn't be able to authentication in Active Directory, access resources, etc – Jevgenij Martynenko Apr 24 '17 at 14:06
  • Depending on make and model, you may be able to configure your 192.168.0.1 so that it acts as secondary DNS server for your internal AD zone ... – Hagen von Eitzen Apr 24 '17 at 15:06
  • 1
    @HagenvonEitzen DDNS updates from PCs won't work on secondary servers. So the suggestion might solve the issue partly, but would bring other problems – Jevgenij Martynenko Apr 24 '17 at 18:39
-4

Adding the modem is not a good idea, no.

Scenario:

Your internal DNS server fails to respond, for some reason or other. This causes a delay as it times out.

Then if it asks the modem it would get no response. This introduces a second delay as it times out.

Then it would try Google, which one would assume would respond as long as you have a connection.

So, removing the modem entry will make it get to Google more swiftly if your internal DNS fails to respond.

Bottom line is that you should be able to rely on your internal DNS. But if you can't trust it then having Google as a backup isn't a problem.

| improve this answer | |
  • suspect someone downvoted because if the modem is down, the internet will be unreachable. A simple office setup is unlikely to have multiple redundant links. – Criggie Apr 24 '17 at 7:29
  • 3
    Downvoting because this suggests it is acceptable to add non-internal domain controller-based DNS servers as additional DNS servers on the client or server network interface cards. That will cause untold problems due to the implementation of the Client Side Resolver service, which will hold on to its DNS preference for an extended period even after the server comes back up. See this article for more details: blogs.msmvps.com/acefekay/2016/10/15/… – Cosmic Ossifrage Apr 24 '17 at 10:40
  • Fair enough, @Cosmic. In fact, my first thought in answering this was to say that the user shouldn't have any settings of their own at all, if they are using an internal DHCP/DNS server. But the OP seemed to really be asking specifically about listing the modem so I answered accordingly. – SDsolar Apr 24 '17 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.