Dns secondary zone configuration

---

So, i got a company with two locations, both have their own DC, replicating with each other through a vpn tunnel and a Dns server configured with each local IP range, it occurs to me that it would be a good idea to configure a secondary zone in each dns and get them to replicate each other so if one goes down the other will take care of the dns service until the Master dns is up again. Of course will have to add the other server as secondary dns in every piece of equipment on both sites..

Is this a common scenario? Would it work ok? Thanks!!

Hello @Sebastian-Gonzalez ,

I would definitely recommend configuring nodes with more than one DNS server address for fault tolerance, as you suggested. This is a Microsoft best practice as well.

Also, as you have mentioned, you will have to add a second DNS server address to all nodes as well. DHCP would make this matter trivial, if that is an option. Manual configuration is another option, but this is tedious and error prone. (I always make a typo on one or two machines). I would suggest a script to automate the process, if DHCP isn't an option.

I'm not sure I understand the separation of DNS by IP range. Do you mean the two DNS servers replicate a single zone, but nodes at one office use one DNS server address, and nodes at the other office use the other DNS servers address? Or does each DNS server have a zone with only the nodes from that office?

Hi Mike!

Actually at the moment, there is no DNS replication, each location works independently on DNS, each with a primary zone, (but they do replicate AD) i imagine it was configured like this because of the IP addresses on each location being in a different range (182.x.x.x in location A and 183.x.x.x in location B) but, with this scenario if the DC that is working as AD, DHCP and DNS on location A (or B) goes down, all the services go down..

That's why i was thinking about creating a secondary zone for each DNS server, so they could replicate each other and get both IP ranges on each DNS, Location A with primary zone 182.x and secondary zone 183.x and Location B with primary zone 183.x and secondary 182.x

And definitely, DHCP will be doing the config of the endpoints and such.

Later on i will check how to do the same with the DHCP.. but that's for a different thread hahaha

Thanks again Mike!

Hey @Sebastian-Gonzalez ,

Always fun trying to figure out what the last admin did and why 🤔

DNS zones are based on namespace, not IP address, so I would think maybe set up this way for connectivity reasons.

Is there an always on connection between the offices?

Yes, its a fun challenge and yes there is a vpn tunnel that's always on, supposedly for DC redundancy..

Hey Mike,

So this would be the way to have dns redundancy for both sites? Having two dns with crossed secondary zones because of the network configuration of the sites?

Thanks!!

Hey @Sebastian-Gonzalez ,

I don't see the need for two separate zones. I'm pretty sure you would not be able do that, create a secondary zone for the same namespace. I am assuming you only have one domain.

I think one zone to rule them all would be the best way to go. That zone would be replicated between both DNS servers. If both offices are part of the same domain, then you only need one zone. The nodes at office A can use the DNS server at office A as there preferred DNS server and the DNS server at office B as their alternate DNS server. The nodes at office B would use DNS server at office B as their preferred DNS server, and the DNS server at office A as their alternate DNS server.

In this scenario, both DNS servers would need a writable copy of the zone. That would mean using Active Directory integrated zones.

Let me know if this makes sense, I am having trouble uploading a diagram :(

First of all, thanks for your time and patient to respond Mike, i really appreciate it.

Now i see where the issues is coming from, when this was mounted, each DC on each location installed it's separated DNS server (not integrated with AD), that's why when i open the DNS console on Location A i only see the IPs translations for the location A and not both, and that's why when i turn off un DC even if the alternate DNS on the endpoint indicates Location B the endpoint is not capable of resolve any IP, does this makes sense to you?

Hey @Sebastian-Gonzalez ,

Yep, that explains why you were having name resolution issues if one DC wasn't available. Once you transition to AD integrated zones, those issues should be gone!

Luckily, it's a pretty painless transition. You should be able to go to the properties of the zone and on the general tab, click change next to "Type". There you will see a checkbox for "Store the zone in Active Directory" (Primary should already be selected).

You will need to remove the zone from the other domain controller. Once you change the zone on the first DC to AD integrated, the DCs will replicate, including the new zone. You don't want an existing zone with the same name on the second DC. You also need to maintain name resolution for the clients throughout the process. Here's my suggestion, I;m sure there are many ways to accomplish this.

1. Use DHCP to assign the appropriate preferred and alternate DNS server addresses.
2. Remove the zone from one domain controller
3. Change the zone on the other domain controller to AD Integrated
4. Use AD Sites and Services console to force replication (probably not necessary, should replicate the change pretty quick)
5. Verify the second DC now has a copy of the new AD Integrated zone

Keep in mind that once yo remove the zone from the one domain controller, clients using that server for DNS will not have name resolution until the AD integrated zone replicates. The whole process shouldn't take long, assuming everything goes as planned. But......you might want to do this at the end of the day just in case.

Hey Mike! Sorry for the late response, at the end i decided to create New DCs with dns integrated to ad and start from scratch, since the actual DCs where ws2008 and i did not wanted to go through the Update path.. Thanks for all your help, i learned a lot with your replies!!

@Sebastian-Gonzalez ,

Awesome. Good luck and let me know if you have any more questions!