DNS Secondary Servers and Zone Scopes - Can't add record to zone scope, error WIN32 9703

Bill Mowery 1 Reputation point
2021-10-30T11:00:55.007+00:00

I'm using Powershell to develop some custom DNS management tools for Server 2016 / 2019 for multiple domains.

Implementing split brain DNS as outlined on Microsoft recommendations (https://learn.microsoft.com/en-us/windows-server/networking/dns/deploy/split-brain-dns-deployment) requires an additional zone scope to contain public IP addresses for the zone, while the default zone scope contains private / internal addresses.

All works well when configuring the primary, non-AD server. Names resolve as expected, and the primary DNS server is well behaved.

The problem arises when configuring the secondary server for the zone. Creating any records in the additional zone scope of the secondary server fails:

Add-DnsServerResourceRecord -Name . -NameServer secondary.contosso.com -NS -ZoneName contosso.com --ComputerNamesecondary.contosso.com -ZoneScope external

and Powershell complains vehemently with a Win32 9703 error, which simple means that a node can't be created in DNS.

The conclusions of my efforts and research say that a zone scope on a secondary server is pretty much useless - you can create one, you just can't populate it with any records in an automated fashion. Perhaps it can be created by copying and hacking zone files, but it seems this defeats the purpose of DNS management and would quickly become impractical in a large scale DNS implementation.

If the secondary server is changed to be primary then all DNS commands work as expected, which tells me that it's not a problem with command syntax or execution (the same commands function properly on all primary DNS servers). Of course making both servers primary defeats the purpose of zone replication, so that's not an answer either - you're back to the same problem of maintaining multiple servers for the same zone.

In summary, it seems that unless you're using zones that are Active Directory integrated, you're pretty much hosed in trying to implement a multi-server split-brain DNS policy. There are many implications of this fact in online forums, but no concise and definitive statement of the fact.

Thoughts?

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,362 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rich Matheisen 44,776 Reputation points
    2021-10-30T14:51:39.593+00:00

    Secondary DNS zones are managed by replication from the primary zone, not by direct modification.

    How have you configured that primary zone for replication? Is it done on a schedule or do you use notification? In the primary DNS server for the zone have you added the secondary DNS servers?

    This really isn't a PowerShell thing. It's the way DNS works.

  2. Limitless Technology 39,351 Reputation points
    2021-11-03T10:41:03.713+00:00

    Hi there,

    The DNS zone information is actually stored as a partition in the active directory database. When Active Directory replicates, the zone data transfers. For standard DNS deployments, the data is stored in a file. You have to configure zone transfers manually in the DNS console.

    You can try forcing the DNS to replicate and see if it is helpful.

    --If the reply is helpful, please Upvote and Accept it as an answer--