Home / server / Questions / 558811
In Process
Matt Bear
Asked: 2013-12-03 18:01:57 +0800 CST

DNS Server replication created duplicate A-Records

  • 772

I have a several Windows Server 2008 R2 DC/DNS servers locally, RODC's at the remote office, and a Windows Server 2012 DC/DNS server on Azure with a VPN tunnel established.

Earlier today I moved a webserver, changed the DNS records on one of the local DNS servers, and updated at the registrar. Everything worked as expected.

Then weird issues started popping up, some people being directed to the wrong server, others to the correct one.

After troubleshooting, I checked the local DNS server again and the records were still correct, until I hit refresh, and the old A-Records popped up in conjunction with the new ones.

The way these records are set up, is a forward lookup zone with one static A record using the parent domain for each zone.

So there ended up being two A-Records with different IP's for the URL's that I had changed earlier in the day, and the old records showed back up in DNS manager when I refreshed the screen. (I had checked several times previously without refreshing)

Fortunately this only affected internal users and not all of them at that, all external users were unaffected because the public DNS records are published through a registrar (GoDaddy, independent so unrelated).

What happened? And how can I prevent this from happening again?

domain-name-system

2 Answers

  1. Nope, that's not what happened. Assuming you're talking about AD Integrated zones, DNS records are objects in AD. Objects have a USN which is essentially a number that increments whenever a change to that object is made. If your tunnel "blipped" the USN would be incremented on your on-prem DCs and not on your Azure-hosted DC. This means that when it came back online, it would see that it had an older copy of the record and update inbound. It wouldn't replicate the old record outbound.

    As to why it happened, it's really next to impossible to say without getting deep into your environment.

    • 4

  2. Since the old records reappeared in Windows DNS, one of two things are likely to be happening.

    It's possible that AD auto-registration put the "old" records back once they were missing. Machines will register all their addresses unless you disable it in the network adapter properties.

    If not that, you have some kind of strange replication problem. Replication in this way happens with other AD data, typically, so you can use repadmin to validate. However, simple connectivity problems shouldn't cause this, because every record has a serial and attempts to replicate old records overtop new ones are ignored.

    AD replication problems are by far the less likely scenario.

    • 2