We have DNS server running on our domain at our main site. We have 4 remote sites connected via a vpn. So we have a domain controller at each location. DNS server is setup on each of those servers as a secondary zone to the main DNS server at our main location.

Weird thing going on, on our main DNS server, it shows all the computers and IP's of the main site and only two of the remote sites. However, the two remote sites that are not showing up, it at least shows the server for each site.

Now if you go to the remote site server and look at that DNS server, it shows all 5 sites and their computers and IP's.

Why would our primary DNS server be missing the two sites?

  • 2
    What does dig <yourdomain> NS say? What if you add @<primaryserver> ? What about @<remotesite> May 15, 2009 at 14:29
  • Is this on Windows, and what version? If you can clarify that you'll get a little better help. Is the DNS zone AD-controlled, or manually entered?
    – Brent Ozar
    May 17, 2009 at 20:31

3 Answers 3


If "DNS server is setup on each of those servers as a secondary zone" then this zone is not Active Directory-integrated.

I need to check this but I thought secondary zones were read-only even in Windows DNS server. Assuming dynamic DNS updates, clients attempt to register their records with their primary servers, which is probably the DC at each site, depending on how you have configured your DHCP. If you really have those servers configured as secondary servers then they won't accept updates (?) and no zone transfers will be pulled by the master DNS server.

Something doesn't make sense here - can you add detail to the question?

  • sorry for the long delay, this got us close, as when diggin around, we notice a setting was off and we updated it and it took care of it. Thank you for everyones respones.
    – jherlitz
    Jun 3, 2009 at 19:37

Sounds like a replication issue. Go into "Active Directory Sites and Services" and verify that your main site is configured with links to pull info from your remote sites. Sounds like you have AD-integrated DNS so I believe replication happens through AD.

  • This really does sound like AD updates are not being propagated back to the home-office Site. There are some Event Log entries you can look for but I don't remember them off the top of my head. Forcing a sync through AD Sites MMC should generate log-entries if it fails, though.
    – sysadmin1138
    May 19, 2009 at 5:18

Did you configure the main DNS to allow zone transfers to the secondary servers? As a security issue you should limit those only to the hosts you know.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.