I'm decommissioning an old Windows domain controller and validating DNS on the replacement server at 192.168.214.15 with dcdiag /test:dns. The Delegations test reports this for the _msdcs.ourdomain.lan zone: "DNS name does not exist" and "[Missing glue A record]."
In DNS Manager, the _msdcs zone appears to contain the expected records. The name server list shows the two current domain controllers, the SOA points to the new server, and the NS and CNAME records appear to reference the new servers. I've also scavenged records, cleared the DNS cache, and flushed DNS, but the warning remains.
What should I check or change to clear this delegation error?
3 Answers
Inspect the _msdcs delegation itself rather than only browsing the records inside the zone. During a domain controller removal, NS records for the old controller can remain attached to the delegation, causing dcdiag to report a missing glue record. Remove stale NS entries and ensure the delegation lists only the current DNS servers.
A glue record is an out-of-zone A or AAAA record for a name server referenced by an SOA or NS record, typically when the name server’s own name is inside the delegated zone. Also, delegation name servers should not be aliases. If the NS entries point to CNAMEs, replace them with the actual host names and make sure those host names have valid A records.
Glue records are generally needed when a delegated zone is publicly resolvable and its authoritative name server is inside that delegated zone. For an internal Active Directory DNS namespace, this warning is usually not about an Internet-style glue record. Check the _msdcs delegation and its NS records instead.
So if the internal namespace were widget.local and the external domain were widget.com, I would only need an internal A record when something such as exchange.widget.com should resolve to an internal server, correct?
Thanks for the hint. Where exactly should I look to inspect or edit the delegation?