What are the basics for DNS on a Domain Controller?
AD-DNS runs on DCs because clients need SRV records to find DCs and services. A few rules prevent 80% of the typical mistakes.
Try this first
- 1A DC never points only to itself for DNS. Prefer: primary = another DC, secondary = self, or in a single-DC setup primary = self but plan the second.
- 2Clients and servers point only to internal DCs for DNS, never to 8.8.8.8 or ISP DNS. External resolution goes through forwarders on the DCs.
- 3Use Active Directory Integrated zones so replication runs automatically, avoid leaving static zones on a single server.
- 4Create reverse zones for the subnets in use, otherwise many security tools and logs fail on name resolution.
- 5Enable aging and scavenging so stale records (laptops that no longer exist) get cleaned up, otherwise duplicate and wrong A records pile up.
When to bring us in
With split DNS (same domain name internal and external): document which records are overridden internally, otherwise two years later a mail route mysteriously disappears.
See also
- One DC or two DCs for an SMB office?Two is almost always the right answer; one DC is a single point of failure for logon, DNS and GPOs.
- Should I split FSMO roles across two DCs?For a small domain all on one DC is fine; with two DCs splitting is tidier but not required.
- How do I know my AD replication is healthy?Replication errors creep in silently; they only surface when logins or GPOs misbehave.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.