DNS entries for forward lookup zone in separate forest needs manual updating

wrinks

6/26/24, 1:49 PM

I am trying to help DNS name resolution work consistently across a company's three separate domains. These domains are also separate forests. They are physically networked together with a site-to-site VPN connection. There are forward lookup zones created that list these separate domains/forests in some of the DC/DNS servers already. These are primary zones. However, this data does not appear to be synced. I currently have to manually add A and matching PTR records for each IP device I want to add to DNS, which is time consuming and mistaken prone.

Upon further inspection, it looks like zone transfers for the parent domain are not enabled (example: on DC1 in forest1, zone transfers are not enabled and on DC2 in forest 2, zone transfers are not enabled), though they are enabled for the already existing forward lookup domains on each search for currently external domains (forward zone for forest2 on forest one allows zone transfers and vice versa)

I’d like to try and allow these separate forests to be synced in regards to DNS, but I’m not sure how to go about that. I was thinking possibly enabling zone transfers, but I’m not sure how the already existing forward lookup zones would affect this since they’re not currently synced, and these servers are both DC servers so that may interfere with how AD replicates?

We could try joining these separate forests but are trying not to go that route right away due to the time commitment involved.

References:

DNS and Forward Lookup Zones

https://community.spiceworks.com/topic/884148-combining-2-active-directory-forests

0 + 3

windows

active-directory

joeqwerty

6/26/24, 2:15 PM

If it were me, I'd convert these zones to AD integrated zones and configure conditional forwarders.

wrinks

6/26/24, 3:06 PM

@joeqwerty In the AD DNS UI, under the forward lookup zone for the domain controller, in the 'Type' coluom it as Active Directory-Integrated Primary for each zone already.

wrinks

6/26/24, 3:17 PM

@joeqwerty So, not sure if that means there's an issue with replication across these forests, or something else? I have dealt with inter-domain replication issues but am unfamiliar with dealing with them intra-domain/across forests.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: DNS entries for forward lookup zone in separate forest needs manual updating

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.