AD/DNS Replication Best Practice and Advice

hello,

i have new forest abc.local , added new root domain test.local. in future add several more root domains.

in abc.local forest root, there exchange servers accessed forest users , nothing else. in test.local there resources related domain.

my question is, how should set replication future domains not replicate unnecessary information each other. of the 3 choices, replicate every dns server in forest, every dns server in domain, or to specific partitions, best option scaling? (i prefer not using manual partitions since can complicated , messy). every domain need replicate root of forest?

i should mention 1 way trust set between test.local , futuredomain.local futuredomain.local can authenticate , connect directly test.local resources name, not other way around. also, trusts between forest root abc.local , other domains?

i want keep future domains segregated, functional. should do?

thank you!

it determine "unnecessary" means. if clients need resolve names other domains in same forest, need contact dns server hosts records domain - can either dns server in local domain (if include zone in forestdnszones) or a dns server in target domain (if limit scope of replication using domaindnszones instead). 1 of these scenarios makes more sense depends on patterns of name resolution queries expecting see. in other words - need choose between increased volume of ad replication vs. increased volume of inter-domain dns queries...

btw. note having multi-domain forest not recommended design - , can have single root domain in forest.

as far trust relationship concerned, @ least need cross domain dns name resolution between dcs in both forests. i'd suggest using selective authenication if want protect access resources in 1 of them (http://technet.microsoft.com/en-us/library/cc794747(ws.10).aspx)

hth
marcin

 

Windows Server  >  Directory Services