Deploying Domain Controllers with an Availablility Group

[Lynn Towle]

Most Microsoft documentation states to deploy DC's in an availability group for maintenance and failure situations.

The issue is that all the servers in an availability groups all use the same DNS settings, which doesn't work for several well known reasons.

The only solution is to either build another availability group with additional DC's, (Which can add a significant cost to the project) or point the original availability group back to on-prem DC's, thereby negating the reliance on on-prem architecture.

Is there any new guidance for this situation?

[#2]

I'm not sure what you mean by 'servers in an availability groups all use the same DNS settings'.

A VM NIC in Azure, by default, inherits its DNS settings from the virtual network.  Open the VM nic resource in the Azure portal - DNS servers and you'll see two options:

'Inherit from virtual network' - this is the default setting for a NIC

'Custom' - allows you to use custom DNS settings for that VM NIC

[#3]

An Availability set works differently than individual VM's. All VM's in an availability set use the same DNS settings. When you change one NIC DNS settings, that setting will propagate to all servers in the Availability Set. If you try to manually change the DNS setting, say in the VM, when the VM reboots, it will inherit the DNS from the Availability set.

This creates an issue specific to DC's where at least one DC will have it's primary DNS pointing to itself, which in not best practice.

[#4]

I've just run up 2 VMs in an availability set and can change the DNS settings on a single NIC on a VM in the availability set. 

[#5]

Ah, sorry.  I'm with you now 

So yeah the options are:

Don't use AV sets for your DCs (use the notifications of planned maintenance if you need to know if/when your VM will be rebooted https://docs.microsoft.com/en-us/azure/virtual-machines/windows/maintenance-notifications)

Put a single DC in your AV Set (which seems kind of pointless)

Settle on the fact that one DC in an AV Set will use itself as its primary DNS server

Point your Azure hosted DC's to your on-premises DCs as their primary DNS server (this may be the least bad option) 

I admit none are brilliant options.  

[#6]

Here are a couple resources. This has been a known issue for a while, but there hasn't been much direction from Microsoft regarding it.

MSDN post

A quick search on uservoice brough this up: UserVoice

For your test, change the DNS of one of the NICs in the Availablity set in the Portal, not using PowerBI, it will post a message stating that all servers will be rebooted to inherit the changes.

[#7]

If you have requirement to use different DNS setting for your VMs, create two vnets with different DNS configuration and place your VMs in 2 different Availability Zones on each vnet.