Good evening! Im trying to make a high availability environment on my work, in order to do that I setup a little lab installing 2 servers; one with WS 2008 R2 and the other with WS 2012 R2 (same as real environment but virtuals). The domain controllers and dns was installed successfully on both and replicates without problems

  1. Server 1 (primary), WS 2008 R2, IP=, dns primary=, secondary=loopback
  2. Server 2 (secondary), WS 2012 R2, IP=, dns primary=, secondary=loopback

I did not use AD integrated dns zone, instead primary/secondary zones were configured. The problem comes with clients, if I make a query to primary dns work well, when primary is shutdown I have no response from secondary even after a long wait, ipconfig /flushdns does not work either nor rebooting. Am I doing some bad configuration?

I get a good response with commands repadmin /showrepl and dcdiag /test:dns /dnsbasic, it seems like no errors were found. Funny thing is when I use Linux i got a response from secondary dns server.

Thank you in advance.

  • 1
    1. Why did you choose to not make the zones AD integrated? That's the most common configuration. 2. Each DC should use it's own ip address as secondary DNS and should use loopback ( as tertiary DNS. 3. Are the clients configured to use both servers for DNS? – joeqwerty Dec 8 '18 at 5:16
  • when primary is shutdown I have no response from secondary even after a long wait - Can you explain the exact problem in more detail? – joeqwerty Dec 8 '18 at 5:20
  • If you scan the secondary, is it listening on port 53? Can you connect to it with nslookup ("server") ? – Larryc Dec 8 '18 at 10:14
  • Sorry, it was too late for edit. @joequerty: I did not made the first configuration on the server, it was already there so I dont have the permission to touch anything yet. Yes, clients are configurated with both servers, been .10 primary. My problem is the secondary dns does not give any answer in windows clients, shutting down first one (.10) and using nslookup for test. This is the answer it gives when both are alive default server: ws2k8ad.domain.lan address: and after i shutdown that server just throws a timeout. How do I test dns without nslookup? – Pepe Dec 8 '18 at 21:33
  • In this scenario, nslookup isn't the right tool. Nslookup only uses the default (primary) DNS server. It will not failover to the secondary or tertiary DNS server. Are you having specific AD/DNS problems when the primary DC/DNS server is down? – joeqwerty Dec 10 '18 at 2:54

You can force nslookup to use the DNS server you migth need, either typing:

nslookup anycomputer yourDNSserver

Or interactive:

nslookup server yourDNSserver anycomputer

Sure this doesn't serve as a failback test, but at least you'll find if your clients can have an answer from your secondary DNS server.

By the way, not really sure about this (and cannot find documentation to confirm or discard) but Powershell command Resolve-DnsName should fall back to the secondary DNS server. As per my tests, this is true, but again, I cannot find documentation.


windows built-in nslookup does not "ever" use the secondary DNS IP configuration to look up (but it actually works - if you ping the hostname it will show you the IP).

I found it the hard way, only after I installed BIND which comes its own version of nslookup - it comes back with the IP address of the hostname and shows that the secondary DNS server provided the information. Try BIND's nslookup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.