I'm decommissioning an old Windows domain controller. On the replacement server at 192.168.214.15, running dcdiag /test:dns reports a delegation error for _msdcs.ourdomain.lan: the DNS server is listed as 192.168.214.15, but its IP is unavailable and the test reports a missing glue A record with error 9714 (DNS name does not exist).
In DNS Manager, the _msdcs zone appears to contain the expected records. The name-server list contains the two current domain controllers, the SOA points to the new server, and the NS records and CNAMEs appear to reference the new servers. The old domain controller has already been removed. I've also scavenged records, cleared the DNS cache, and flushed DNS, but the diagnostic still reports the error. What should I check or change?
4 Answers
Glue records are mainly relevant when a delegated zone is publicly or externally resolvable. Internal Active Directory DNS normally does not need manually created glue records. If your internal namespace is something like widget.local and your external namespace is widget.com, you would create internal A records only for internal services that need to resolve, such as exchange.widget.com—not a public-style glue record just to satisfy the internal zone.
Check the delegation for _msdcs.ourdomain.lan itself, not just the records inside the zone. When a domain controller is removed, the delegation can retain an NS entry for the old server. If that stale name no longer resolves to an A record, dcdiag reports it as missing glue. Remove the obsolete delegation or NS entry and make sure the current DNS servers are listed there.
The delegated name servers should use their actual host names, not CNAME aliases. DNS delegation records are expected to point directly to authoritative DNS servers, and each server name needs a valid A record. Replace any alias-based entries with the real server names, then restart or reload the DNS service and run dcdiag /test:dns again.
A glue record is an extra A or AAAA record used when a delegated zone's authoritative name server is located inside that same zone. For an internal Active Directory DNS namespace, this warning is often caused by a stale delegation rather than a genuinely missing record. In DNS Manager, inspect the delegation properties for _msdcs and verify that every listed name server resolves correctly.
That helps. I was checking the contents of the _msdcs zone, but I hadn't inspected the delegation itself. I'll verify that the old controller isn't still listed and that the current server names resolve directly.