Home / server / Questions / 446364
Accepted
joeqwerty
Asked: 2012-11-08 08:13:11 +0800 CST

Domain Controller DNS Best Practice/Practical Considerations for Domain Controllers in Child Domains

  • 772

I'm setting up several child domains in an existing Active Directory forest and I'm looking for some conventional wisdom/best practice guidance for configuring both DNS client settings on the child domain controllers and for the DNS zone replication scope.

Assuming a single domain controller in each domain and assuming that each DC is also the DNS server for the domain (for simplicity's sake) should the child domain controller point to itself for DNS only or should it point to some combination (primary VS. secondary) of itself and the DNS server in the parent or root domain? If a parent>child>grandchild domain hierarchy exists (with a contiguous DNS namespace) how should DNS be configured on the grandchild DC?

Regarding the DNS zone replication scope, if storing each domain's DNS zone on all DNS servers in the domain then I'm assuming a DNS delegation from the parent to the child needs to exist and that a forwarder from the child to the parent needs to exist. With a parent>child>grandchild domain hierarchy then does each child forward to the direct parent for the direct parent's zone or to the root zone? Does the delegation occur at the direct parent zone or from the root zone?

If storing all DNS zones on all DNS servers in the forest does it make the above questions regarding the replication scope moot? Does the replication scope have some bearing on the DNS client settings on each DC?

domain-name-system

2 Answers

  1. Best Answer

    I'd rather go with a single domain using your two servers for redundancy than to use two separate domains on single (point of failure) servers. What is driving your choice to go with a parent/child domain forest? You could just use the DNS space for the child domain since you said it's contiguous without requiring an AD domain unless you have security boundary concerns.

    Against my better judgement, I'll answer the question assuming you have two servers for each domain (four total) -- just subtract two of the servers for your case.

    Option 1.

    With your desire to keep DNS local to the domain, the parent DCs point to one another and the child DCs point to one another as well. The easier configuration would be to use a scope that replicates the DNS zone forest-wide.

    You have parent.local (or whatever) as your top-level and child.parent.local as the subdomain.

    AD will replicate both domains throughout the forest making DNS resolution simple. You'll see overlap on a given DNS server with the zones, but Windows deals with that.

    Option 2.

    Another option is to not do forest-wide replication in which case I would simply configure a forwarder on the child DCs to send everything up to the parent DCs DNS, but on the parent you'll need to create a delegation for the child subdomain back down.

    • 2

  2. Honestly, to provide a "best real-world practices" answer, I think you need to add one more piece of info. Where are all the dcs/ DNS controllers going to be physically located? If the children are at separate physical sites, you want each to have their own child domain stored locally and not in the forest. Best practice calls for an empty forest. DNS servers should always point to themselves first and then use a forwarder t point up to its parent (or the forest). An easy way around the slow boot issue is to add itself to the local hosts file (although I seem to also remember a reg fix for this).

    • 0