W2K3 DNS problems after domain upgrade

[Mike_982]

Hi, folks. I'm new to the board and wondered whether any of you gurus can help me out. Sorry this is a bit long-winded - thought I'd better give more detail rather than less.

I've upgraded an NT4.0 + SP6a PDC to W2K3 Std., with no apparent problems (NT4 BDCs still replicate fine), until I come to create a new W2K3 DC in the same domain. I'm pretty sure that the problem is DNS-related, but I'm still trying to figure out where and what to do about it.

There are some apparent DNS discrepancies between my new AD-integrated zone and another in an unrelated domain (see below), and I'm wondering whether to

a) try to make the problem zone identical by manual changes;

b) delete all the DNS zones (even uninstall DNS) and reinstall and or recreate the zone (not sure whether I can do this, though, as it's the only W2K3 DC at present);

c) try something else.

The problem I encounter is as follows:

The intended new DC is already running W2K3 and is a member server of the domain. When I run dcpromo, I get a failure message as follows:

"An AD domain controller for the domain could not be contacted. Ensure that the DNS domain name is typed correctly."

It is, so proceeding to the details, I see:

"DNS was successfully queried for the service location (SRV) resource record used to locate a domain controller for domain :

The query was for the SRV record for _ldap_tcp.dc_msdcs.domainname.com. The following domain controllers were identified by the query:"

Here it gives the correct FQDN of the W2K3 DC, i.e. servername.domainname.com. It then says:

"Common causes of this error include:
- Host (A) records...missing or contain incorrect addresses.
- Domain controllers registered in DNS are not connected to the network or are not running."

The W2K3 DC is connected and all services are running, and the host record for it does appear in the domainname.com (AD-integrated) zone.

Other info:
- all machines concerned are on the same class 'C' subnet.

- A ping by name to the existing W2K3 DC from the intended W2K3 DC appears to fail to resolve in DNS, and only succeeds via subsequent broadcast (this from netmon data).

- The DNS structure shows domainname.com and _msdcs.domainname.com as zones at the same level. An unrelated AD domain I checked has _msdcs (no 'domainname.com') as a node below domainname.com, and there are other discrepancies.

- The intended W2K3 DC has the existing W2K3 DC as its DNS server in its IP config. The existing W2K3 DC points at itself.

- A standard primary zone of the same name (domainname.com) exists on one of the NT4 BDCs, with a standard secondary of that zone on another NT4 BDC. As far as I'm aware, the std. pri/sec zones and the AD-integrated zone of the same name shouldn't interfere with each other at his stage. All clients (apart from the new intended new DC and another new server point to the old zones for name resolution.

- Before the name of the W2K3 DC has been cached by the box I'm trying to promote, nslookup shows the DNS server as servername._tcp._msdcs.domainname.com when I run it. Queries for names in the DNS database appear successful.

- After the name of the W2K3 DC has been cached by the box I'm trying to promote, nslookup shows the DNS server as servername.domainname.com when I run it, and queries again appear successful.

OK, that's about it. Any help gratefully received. Thanks.

[Ivan Ferreira]

What about the reverse zone?

It exitsts? The PTR record for the domain controller corresponds with the A record?

The W2K member server that you want to promote, has as DNS server the W2K3 DC only, not the NT4 DNS server?.

[Mike_982]

Hi, Ivan. Yes, the reverse zone exists, the PTR record corresponds to the host record for the DC and the server I want to promote has only the existing DC as its DNS server.

A host record and a corresponding PTR record also exist for the server I'm trying to promote.

Regards,
Mike

[Ivan Ferreira]

If you run DNS tests from the DNS console, do you get success?

If you use nslookup, can you resolve the existing W2K3 DC? Run nslookup on the existing W2K3 DC and the intended DC.

Use, start run, nslookup:

Then type in the server name, like

server1.example.com

You should get the IP address.

[Mike_982]

The simple query test passes, while the recursive query test fails, but I suspect this is because the firewall hasn't yet been configured to allow queries to be forwarded (I don't have access to do this and the guy who does isn't available right now).


I shouldn't think this would cause the problem I've got, as name resolution for the DC shouldn't need to be forwarded.

Nslookup returns IP addresses for both the DC and the intended DC, when run from either machine, which of course would normally suggest DNS is OK...

Regards,
Mike

[Melissa Schaefer]

I noticed this comment below .. Your current DNS server points to it's self, and the W2K3 member server that you are trying to promote has the main DNS server ip in the Tcpip settings right? Do you see anything in the event log that might lead you to something?? Check out article
Q247811 Not sure if it will help but sounds like it is worth a try

- The intended W2K3 DC has the existing W2K3 DC as its DNS server in its IP config. The existing W2K3 DC points at itself.