Not all Active Directory DNS Servers will resolve a new DNS record

problem: not active directory dns servers resolve new dns record. new cname or record added dns of 1 server , after replication time allotment other dns servers cannot resolve new record. seems intermittent new dns record resolve expected dns server. these new records , not subject tombstoning yet.

environment: many cross site domain controllers using active directory integrated dns (secure only), 2008 r2 servers few 2003 r2 servers, forest/domain function levels @ 2003. main forest dns zone replicating dcs in forest.

troubleshooting:

at first suspected replication issue, after using adsiedit , connecting dc=forestdnszones,dc=********,dc=*** a dnsnode instance found each problematic dns record on every domain controller. wasn’t getting published dns service. digging little deeper, found that these new dnsnode instance security permissions included permissions inherited zone , did not include “default security” permissions of dnsnode class defined active directory schema. 

workaround:

opening advanced security settings problematic dnsnode instance in adsiedit , clicking “restore defaults”, applies schema defined default security permissions inherited permissions hosting zone, allow dns record published dns service. ‘fixes’ issue 1 broken dns record, has done each time these dns records no publish

root cause: not found!!

what cause schema defined default security permissions not apply ‘some’ new dnsnode instances causing dns records not publish same servers dns service?

hi,

are receiving error message? if yes, please provide detailed error message our further research. in addition, hope below thread helpful:
adding secondary dns server
http://technet.microsoft.com/en-us/library/cc776953(v=ws.10).aspx

regards,

---

mandy ye

Windows Server  >  Directory Services