Forum Discussion

THECAESAERC's avatar
THECAESAERC
Copper Contributor
Sep 16, 2024

DNS Issue

Server 2019 client Windows 11   A client workstation has 4 DNS servers we expect to work in a "round robin". The servers are: accounting research dev admin   The systems we are trying to acc...
Ted_Mittelstaedt's avatar
Ted_Mittelstaedt
Brass Contributor
Dec 29, 2024

Because the Windows client resolver does not work this way.  When you hand out IPv4 DNS server IP addresses, several hard-coded assumptions are made by Windows:

  1. The first DNS server in the list is ALWAYS going to be used unless it's offline.
  2. All DNS servers in the list are Microsoft Domain Controllers because the Windows client is supposed to be able to get replies to proprietary Microsoft DNS query extensions.  For example, IETF does not define a record for "give me IP address of a Domain Controller for the domain I'm a member of" while Microsoft does.
  3. The first DNS server on the list has sufficient power/memory/CPU resources to respond to ALL DNS queries it might get from ALL clients on the network if the queries come in at the same time.  For example, suppose a power failure takes down the ethernet switch infrastructure.  On power-up, all clients will appear on the network at the same time, all will start querying for the IP's of the DC's at the same time, all will start querying for DHCP requests at the same time, etc.  Once the server has booted, it's going to be inundated with these requests, and it BETTER have enough power to respond to all of them in a timely manner.

Because of this there's certain items of "good Microsoft Networking practice" that should be followed:

  1. Do not setup a domain controller to do anything other than act as a domain controller/DHCP server
  2. Do break larger networks into subnets.  A rule of thumb I have used is once you get over 100 devices on the network, start thinking about subnetting.  Start by moving self-contained mobile devices like phones and tablets to their own subnet, if you have multiple sites subnet those, if you have a large site subnet by floors, etc.   For supra-large enterprises you may end up going to 500-1000 devices per subnet but you should definitely stick to classful addressing - move to 172.16.X and use 255.255.0.0 or move to 10.x.x.x and 255.0.0.0  etc.  While everything is SUPPOSED to be classless these days, don't make the assumption it is.
  3. DO have multiple domain controllers one per subnet and have them act as DHCP servers for their subnet - unless you are subnetting by site and you have very small sites, then it's OK to centralize DHCP/DC/DNS functionality and use DHCP helper addresses.
  4. DON'T setup a DC as a virtual server.  You are better off with a low-end, non-RAID card, mirrored drive HP Proliant Gen9 running for example Windows Server 2019, then a high end super large ram multiple CPU hypervisor server running a DC in a VM.  Setup the DC to power back up on AC power applied, set it up with a UPS that will wake up and repower on power failure, cabled to the DC for graceful shutdown, with a set of mirrored drives, and let the network beat the heck out of it.

I know a lot of people try to save money in server licenses by trying to combine functions, but you are just going to hurt yourself later on if you do this.  Spend the extra money for another server license and be done with it.

What catches people who want to have a "failover" at the client is Microsoft has never clearly defined exactly what constitutes an offline, non-functioning DNS server that will cause the Windows client to go to the next DNS server in the list.  I've seen people experimenting in a lab to test this and figure it out, but in production what I've always seen is when the first DNS server in the list fails the clients take a big kick in the rear to switch over to the next one.  That almost always results in hesitations and slowness to the user experience, users WILL complain about it.  And, if the first DNS server fails because it's just giving empty query results - then you have a real problem.

It just works better to build the network so that whatever the client gets for it's first DNS server are among the most highly reliable servers in your network.  It becomes a huge mess to remove and decommission a DNS server in an Active Directory that outright fails, and cannot be demoted the normal way and remove all it's objects via the decommissioning process, so don't set yourself up for this kind of failure in the first place by trying to combine DC functions into a user fileserver.

Resources