Home / server / Questions / 716941
Accepted
scampbell
Asked: 2015-08-27 04:57:36 +0800 CST

New Domain DC Adds FQDN (including forest) to DNS - Cant Resolve

  • 772

I added a new domain recently to our AD. It was added using the option to add a new domain to an existing forest.

So now we have the original domain.local which is in the forest also called domain.local. We have added the domain newdom.local to the domain.local forest.

Everything was working fine until I went on holiday for a few weeks and the new DC in the newdom.local domain was turned off (luckily there are no active users in that domain yet). When I realised it had been turned off, I turned it back on but could not access through RDP so troubleshooting began. There are various issues but the main issue I think is DNS seems to be broken, which stops replication occurring.

When running commands like dcdiag /test:dns from the new DC, it cant find itself. It is looking at 31d2ecb5-550c-4111-9f8e-faa78d93eda7._msdcs.domain.local which is a CNAME entry that points towards the DC, but the FQDN in that DNS entry shows as dc-01.newdom.local,domain.local. which cant be resolved (I assume because the forest is in there after the comma). I can however resolve dc-01.newdom.local. no problem.

DNS is replicating this extra ,domain.local for most CNAME and SRV entries causing the new server to not be found.

Is this normal for a new domain in an existing forest to have the DNS FQDN include the forest name? If so, how do I fix DNS to allow resolution of these FQDNs? Alternatively how do I stop them being added?

Thanks for any help.

domain-name-system

1 Answers

  1. Best Answer

    I ended up editing the values below, removing the forest name from the values, then rebooting. All fixed now. No idea why it happened though!

    'NV PrimaryDnsSuffix' & 'PrimaryDnsSuffix' in
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\System\DNSClient

    'PrimaryDomainName' in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters\{4679768C-B011-4489-9EA5-EF6BA8E460CF}

    Edit

    How embarrassing. I had set group policy incorrectly.

    Computer Configuration / Policies / Administrative Templates / Network / DNS Client / Primary DNS Suffix was set to newdom.local,domain.local.

    I should have set Computer Configuration / Policies / Administrative Templates / Network / DNS Client / DNS Suffix Search List instead.

    • 1