Island DNS
AD-integrated zones and a split-brain DNS design can create a conflict known as island DNS. In an island DNS situation, two or more DCs act as DNS servers for a domain, hosting an AD-integrated zone as usual. However, each DC is aware only of itself. Each DC registers its DC-identification information in its copy of the DNS zone but never replicates that information to the other DC/DNS servers (i.e., servers that do double duty as DCs and DNS servers). Therefore, each DC/DNS server thinks that it's the only one on the planet.
Island DNS happens only on a root domain in a forest, only if you're using AD-integrated zones, only if you're using split-brain DNS (with each DNS server configured to refer only to itself when making DNS queries), and only when you have more than one DC/DNS server for the root domain. As far as I know, island DNS can afflict either Windows 2003— or Win2K-based DNS servers.
You can reconfigure your DC/DNS servers to avoid island DNS. First, choose one DC/DNS system to become a "master" DNS server for the zone. (This server won't truly be a master. DNS registrations remain multimaster, but I use the term as a simple way of expressing the concept.) The master DNS server should still point to itself—meaning that in the system's TCP/IP Properties window, the Preferred DNS server field should contain only that system's IP address. The Alternate DNS server field should be blank. Next, set up the other DNS servers so that they use the master's IP address as their preferred DNS server and some other DNS server as their alternate. Except in the case of the master server, never configure a system to point to itself as either preferred or alternate.
Suppose I have three DCs named DC1, DC2, and DC3. All three DCs are also DNS servers, reside in some forest's root domain, and store that domain's DNS zone information in an AD-integrated zone. After arbitrarily choosing DC1 to be the master, I configure DC1 so that its Preferred DNS server field contains DC1's IP address and leave the Alternate DNS server field empty. I fill in DC2's Preferred DNS server field with DC1's IP address, and in DC2's Alternate DNS server field, I use DC3's IP address. I fill in DC3's Preferred DNS server field with DC1's IP address, and in DC3's Alternate DNS server field, I use DC2's IP address.
Consider a two-DC example—same arrangement, but I have only two DCs: MYDC1 and MYDC2. If I arbitrarily pick MYDC1 as the master, I fill in its Preferred DNS server field with MYDC1's IP address and leave its Alternate DNS server field empty. On MYDC2, I would set the Preferred DNS server field to MYDC1's IP address. But what about MYDC2's Alternate DNS server field? The answer is that you should leave it empty.
Adding More Domains
Now, suppose bigfirm.biz wants to have two AD domains—the original bigfirm
.biz domain and a domain named bigfirm.com. Assuming Bigfirm wants to use split-brain DNS, how does the company accomplish such a configuration? Bigfirm needs only to create a primary zone called bigfirm.com on one of its internal DNS servers. The company would set up every other internal DNS server as a secondary DNS server for the bigfirm.com zone. Bigfirm would then have all the DNS infrastructure it needs for a two-domain AD forest.
If Bigfirm is running AD-integrated zones, the next steps would obviously be to make both bigfirm.biz and bigfirm.com AD-integrated zones, set up some DCs running DNS, and presto—each domain's DNS servers would see the others' zones. However, that procedure wouldn't work because of a quirk in AD-integrated zones. AD-integrated zone data goes only to DCs in that zone's domain—bigfirm.biz DC/DNS servers would see only bigfirm.biz data, and bigfirm.com DC/DNS servers would see only bigfirm.com data. Windows 2003 lets you get past this limitation, as I'll discuss in a future column, but for Win2K-based multidomain forests, you'll need to rearrange things a bit to make AD-integrated DNS work. You'll need to configure all of bigfirm.biz's DNS servers to be secondary DNS servers for bigfirm.com and configure all of bigfirm.com's DNS servers to be secondary DNS servers for bigfirm.biz. Each domain can still use AD-integrated zones inside itself, but each domain must contain the name-resolution information necessary for bigfirm.biz systems to locate bigfirm.com DCs and vice versa.
Bigfirm has more options if adopts Windows 2003—based DNS servers. I'll explore those options another time.