We have two domain controllers, and both also host DNS. The first controller runs DHCP, while the second was intended to act as the backup. We had to demote the original primary domain controller and promote or otherwise move the primary role to the other server. As soon as that happened, DNS resolution stopped working across parts of the network. The original controller still had the DNS service installed and running, but its DNS records appeared to disappear. We eventually restored connectivity by changing the DNS server order on some workstations, servers, and the firewall. Why didn't clients automatically use the other DNS server, and how could demoting a domain controller affect DNS when we weren't intentionally changing the DNS configuration?
4 Answers
If the old DNS server was still listed first, it may have answered successfully with NXDOMAIN or an empty authoritative response. DNS clients generally do not treat every negative answer as a reason to try the next configured server. Also check whether the firewall was allowing DNS traffic to the remaining controller and whether affected devices were on the same VLAN. The safest design is usually to run AD-integrated DNS on both domain controllers and configure clients to use both healthy internal DNS servers.
Demoting a domain controller removes its Active Directory data, including the AD-integrated DNS zones and records associated with that domain controller. If the DNS service was left running afterward, it could still answer queries, but respond that records did not exist. Clients that queried it first would receive a valid negative response instead of a timeout, so they might not try the second DNS server. Stopping or disabling DNS on the demoted server, or removing it from client and firewall DNS settings, would have allowed queries to fail over more predictably.
Check whether the DNS zones are AD-integrated or traditional primary/secondary zones. Also inspect DNS Server, Directory Services, replication, and System event logs on both servers. Broken AD replication, incorrect time synchronization, missing delegations, stale records, or scavenging could explain why records disappeared. Verify that the remaining domain controller is a DNS server for the AD zone, that clients and the firewall point to it, and that the old server is no longer advertised as a usable DNS server.
The terminology matters here. In modern Active Directory, there usually isn’t a primary and secondary domain controller in the old sense. You may have transferred the PDC Emulator FSMO role, or you may have actually demoted one domain controller and promoted another. Those are very different operations. Moving the FSMO role normally should not remove DNS records; demoting a domain controller can, especially if DNS zones were not properly replicated or were hosted only on that server.
That explains why the old server could cause problems, but clients still seemed not to query the second DNS server at all. I’m trying to determine whether the issue was caused by the DNS response, incorrect DNS configuration, or a replication problem.