1

I have an environment where Active Directory Domain Controllers host their own DNS domains (as is common).

However we are trying to separate DNS and host it on a standalone server (to eventually move to Linux Bind, but for now just the decoupling)

I have tested this in a lab environment but can't get the decoupling to work.

Step One - Basic Setup

  • Create an AD zone "mylab.com"
  • Add a domain controller "server1.mylab.com"
  • AD can update the domain perfectly fine

Step Two - Move out DNS zone

  • Backup and delete the entire zone "mylab.com"
  • Create a Conditional Forwarder for "mylab.com" pointing to standalone DNS server
  • Manually create a new zone "mylab.com" on the standalone DNS server
  • Allow Insecure Updates on the standalone server (On Bind it would be 'allow-update ACL')

Step Three - Test DNS Updates from AD to Standalone

  • Restart NetLogon Service

this should trigger the DC to create all the AD related DNS records on "mylab.com" hosted on the new Standalone DNS server.

but I don't see any attempts of DNS updates on the standalone DNS server logs.

I do see DNS queries coming in from the DC, but no updates)

madacoda
  • 215
  • 1
  • 9
  • If you don't see updates originating from the domain controllers, try ipconfig /registerdns. Also check the event logs, including the Directory Service log. – Greg Askew Feb 20 '22 at 20:49

2 Answers2

1

I don't see any mention of updating the name server records. The link below describes the process which involves a dns zone transfer.

https://community.spiceworks.com/topic/2266049-migrating-from-windows-dns-to-bind-dns-on-linux

njpdx
  • 86
  • 1
  • You're right, those are important steps. I left them out for simplicity only. When I say "move the zone to the new server" I really do mean all those migration steps. Migrate zone data, zone transfer, change NS records, etc. – madacoda Feb 21 '22 at 03:13
0

The steps are all correct. I got it working with the same steps.

The only issue was the FQDN of the NS records may need to be forwarded separately if they are not part of the same domain. Otherwise the DC won't know where to send the DDNS updates. It does this by first looking up the SOA and NS records of the zone.

In my specific environment, I had to modify the NS records to be in the same zone.

madacoda
  • 215
  • 1
  • 9