I've inherited "ownership" of a network which has a Windows 2003 Server running as a Domain Controller and file server (no IIS or DNS running). We also use an Ubuntu server running dnsmasq as an internal Name Server.
This setup doesn't seem to have been a problem until now - we are installing a new Windows 2008 server (new hardware and everything), and want to migrate services and data from the old server gradually. To start this process, we are trying to add the new server as a secondary controller on our domain. The server is connecting to the domain easily enough, but when we try and specify the forest for the new controller we end up with this error:
The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain "DOMAIN.address.com":
The error was: "DNS name does not exist." (error code 0x0000232B RCODE_NAME_ERROR)
The query was for the SRV record for _ldap._tcp.dc._msdcs.DOMAIN.address.com
Common causes of this error include the following:
- The DNS SRV records required to locate a AD DC for the domain are not registered in DNS. These records are registered with a DNS server automatically when a AD DC is added to a domain. They are updated by the AD DC at set intervals. This computer is configured to use DNS servers with the following IP addresses:
One or more of the following zones do not include delegation to its child zone:
- . (the root zone)
I'm now thinking that the solution is to make the 2008 Server use the 2003 Server DNS instead of our Ubuntu? Is this the right solution? Are there other options? What might I and my team have missed?
I wouldn't put too much effort into having it "play nicely", I'd rather go for AD-integrated DNS instead of dnsmasq...
Now, the new 2008 DC will be able to locate the DC during dcpromo, and everything should work as expected :-)
You would indeed
need want an AD-integrated MS DNS server - doing it differently would require significant configuration overhead. But you could choose to keep your existing name server infrastructure in place and just add MS DNS servers on top of that.
You easily can get different name servers to "play nicely" together by making sure that the name spaces they are authoritative for do not overlap. If your "internal name server" has authority for the address.com zone, it is quite fine to have an AD DNS server with an DOMAIN.address.com zone. To make sure your dnsmasq server is able to answer requests for DOMAIN.address.com you simply might add forwarder definitions for the DOMAIN.address.com zone to your
dnsmasq configuration like this in
or alternatively using the
-S /DOMAIN.address.com/192.168.0.1 command line option to
192.168.0.1 should be replaced by the IP address of one of your AD DNS servers.
If the name spaces do overlap, you are out of luck - as this is outside of the specification of the DNS so any kind of interoperability between primary zone-holding name servers (i.e. the replication of the zone data) would require proprietary mechanisms. While this kind of mechanisms is built into the MS DNS server for replication of AD-integrated DNS zone data between AD DNS servers, no such interoperability is implemented for any kind of 3rd parties.
User contributions licensed under CC BY-SA 3.0