Home / server / Questions / 1162564
Accepted
Michael Cornn
Asked: 2024-07-16 01:03:34 +0800 CST

Windows DNS Policies do not replicate in AD-integrated zones

  • 772

In a lab, I'm testing split-horizon (aka split-brain) DNS policies. The policies set on a DC/DNS server do not replicate to other DC/DNS servers.

Is it possible to make them replicate?

The lab has subnets 192.168.72.0 and 192.168.73.0, and two DCs running DNS. The two DCs have IP addresses 192.168.72.100 and 192.168.73.100.

I created an A record in DNS of host1 at 10.0.0.2

I followed this tutorial from Microsoft the DC with IP 192.168.72.100. The specific commands are pasted below:

Add-DnsServerZoneScope -ZoneName "deez.datz" -Name Scope73"
Add-DnsServerResourceRecord -ZoneName "deez.datz" -A -Name "host1" -IPv4Address "10.0.0.100" -ZoneScope "Scope73"
Add-DNsServerQueryResolutionPolicy -Name "Policy73" -Action ALLOW -ClientSubnet "eq,TGH-North" -ZoneScope "Scope73,1" -ZoneName "deez.datz"

Nslookup from a system in the 192.168.73.0 subnet:

nslookup host1 192.168.72.100
Name: host1.deez.datz
Address: 10.0.0.100
nslookup host1 192.168.73.100
Name: host1.deez.datz
Address: 10.0.0.2

The DNS Policy functions correctly on the first DC where the commands were run. The policy did not take effect on the second DC. The policy did not replicate.

I understand this is the default behavior for Microsoft DNS Policy.

Is it possible to force the DNS policy to replicate (and avoid running the commands on every single DC)?

domain-name-system

1 Answers

  1. Best Answer

    From the documentation, it looks like this is not possible:

    https://learn.microsoft.com/en-us/windows-server/networking/dns/deploy/dns-sb-with-ad#high-availability-of-policies

    DNS policies are not Active Directory integrated. Because of this, DNS policies are not replicated to the other DNS servers that are hosting the same Active Directory integrated zone.

    DNS policies are stored on the local DNS server. You can easily export DNS policies from one server to another by using the following example Windows PowerShell commands.

    PowerShell

    $policies = Get-DnsServerQueryResolutionPolicy -ZoneName "contoso.com" -ComputerName Server01
$policies | Add-DnsServerQueryResolutionPolicy -ZoneName "contoso.com" -ComputerName Server02

    For more information, see the following Windows PowerShell reference topics.

    Get-DnsServerQueryResolutionPolicy
    Add-DnsServerQueryResolutionPolicy

    The same applies to DNS zones which are not AD-integrated and use the standard primary/secondary model: https://learn.microsoft.com/en-us/windows-server/networking/dns/deploy/primary-secondary-geo-location.

    In short: DNS policies are server-specific, you need to configure them on each DNS server in your environment.

    • 1