We have two domain controllers, and both also provide DNS. One server also handles DHCP. During troubleshooting, we demoted the original primary domain controller and promoted the other server to take over its role. Immediately afterward, DNS resolution failed across the environment. The former primary still had the DNS service installed and running, but its DNS records appeared to be missing. Changing the DNS server order on affected workstations and the firewall restored connectivity. Why would DNS fail when the DNS configuration itself was not intentionally changed?
3 Answers
Demoting a domain controller removes its Active Directory-integrated DNS data, even if the DNS Server service remains installed and running. That server may still answer queries, but respond that the records do not exist instead of allowing clients to try the other DNS server. If the old server had been shut down or its DNS service stopped, clients would generally have failed over to the second configured resolver.
The terminology matters here: a modern Windows domain does not really have a primary and secondary domain controller in the old sense. You may have transferred the PDC Emulator role, or you may have fully demoted one domain controller. Those are very different operations. If you actually demoted the server, its AD-integrated DNS zones and records would no longer be available there.
Check whether the zones are AD-integrated or traditional primary/secondary zones, and review DNS, Directory Services, and replication event logs on both servers. Broken replication, time synchronization problems, or stale-record scavenging could also explain why records disappeared. The firewall and DNS client settings should be checked too, since blocking the replacement DNS server would make the outage look like a DNS data problem.
That explains the behavior, although it was confusing because clients did not appear to be querying the other DNS server at all.