DNS Server on Windows Server 2012 does not pass basic, delegations, dynamic updates, and records registration tests upon running DCDiag /c /v, how do I fix this problem? I am new to managing DNS in a small server forest.

Question

C:\Users\Administrator>DCDiag /c /v

 

Directory Server Diagnosis

 

Performing initial setup:

   Trying to find home server...

   * Verifying that the local machine server1, is a Directory Server.

   Home Server = server1

   * Connecting to directory service on server server1

   * Identified AD Forest.

   Collecting AD specific global data

   * Collecting site info.

   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=dc,DC=ca,LD

AP_SCOPE_SUBTREE,(objectCategory=ntDSSiteSettings),.......

   The previous call succeeded

   Iterating through the sites

   Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name

,CN=Sites,CN=Configuration,DC=dc,DC=ca

   Getting ISTG and options for the site

   * Identifying all servers.

   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=dc,DC=ca,LD

AP_SCOPE_SUBTREE,(objectClass=ntDSDsa),.......

   The previous call succeeded....

   The previous call succeeded

   Iterating through the list of servers

   Getting information for the server CN=NTDS Settings,CN=server1,CN=Servers,C

N=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=dc,DC=ca

   objectGuid obtained

   InvocationID obtained

   dnsHostname obtained

   site info obtained

   All the info for the server collected

   * Identifying all NC cross-refs.

   * Found 1 DC(s). Testing 1 of them.

   Done gathering initial info.

 

Doing initial required tests

 

   Testing server: Default-First-Site-Name\server1

      Starting test: Connectivity

         * Active Directory LDAP Services Check

         The host host could

         not be resolved to an IP address. Check the DNS server, DHCP, server

         name, etc.

         Got error while checking LDAP and RPC connectivity. Please check your

         firewall settings.

         ......................... server1 failed test Connectivity

 

Doing primary tests

 

   Testing server: Default-First-Site-Name\server1

      Skipping all tests, because server server1 is not responding to

      directory service requests.

      Test omitted by user request: Advertising

      Test omitted by user request: CheckSecurityError

      Test omitted by user request: CutoffServers

      Test omitted by user request: FrsEvent

      Test omitted by user request: DFSREvent

      Test omitted by user request: SysVolCheck

      Test omitted by user request: KccEvent

      Test omitted by user request: KnowsOfRoleHolders

      Test omitted by user request: MachineAccount

      Test omitted by user request: NCSecDesc

      Test omitted by user request: NetLogons

      Test omitted by user request: ObjectsReplicated

      Test omitted by user request: OutboundSecureChannels

      Test omitted by user request: Replications

      Test omitted by user request: RidManager

      Test omitted by user request: Services

      Test omitted by user request: SystemLog

      Test omitted by user request: Topology

      Test omitted by user request: VerifyEnterpriseReferences

      Test omitted by user request: VerifyReferences

      Test omitted by user request: VerifyReplicas

 

      Starting test: DNS

 

         DNS Tests are running and not hung. Please wait a few minutes...

         See DNS test in enterprise tests section for results

         ......................... server1 passed test DNS

 

   Running partition tests on : ForestDnsZones

      Starting test: CheckSDRefDom

         ......................... ForestDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... ForestDnsZones passed test

         CrossRefValidation

 

   Running partition tests on : DomainDnsZones

      Starting test: CheckSDRefDom

         ......................... DomainDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... DomainDnsZones passed test

         CrossRefValidation

 

   Running partition tests on : Schema

      Starting test: CheckSDRefDom

         ......................... Schema passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Schema passed test CrossRefValidation

 

   Running partition tests on : Configuration

      Starting test: CheckSDRefDom

         ......................... Configuration passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Configuration passed test CrossRefValidation

 

   Running partition tests on : domain

      Starting test: CheckSDRefDom

         ......................... domain passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... domain passed test CrossRefValidation

 

   Running enterprise tests on : domain.ca

      Starting test: DNS

         Test results for domain controllers:

 

            DC: server1.domain.ca

            Domain: domain.ca

 

 

               TEST: Authentication (Auth)

                  Authentication test: Successfully completed

 

               TEST: Basic (Basc)

                  Error: No LDAP connectivity

                  The OS

                  Microsoft Windows Server 2012 Standard (Service Pack level: 0.

0)

                  is supported.

                  NETLOGON service is running

                  kdc service is running

                  DNSCACHE service is running

                  DNS service is running

                  DC is a DNS server

                  Network adapters information:

                  Adapter adapter:

                     MAC address is AA:AA:AA:AA:AA

                     IP Address is static

                     IP address: 0.0.0.0,

                     DNS servers:

                        Warning:

                        0.0.0.0 (server1) [Invalid]

                        Warning: adapter

                        [00000010] adapter has

                        invalid DNS server: 0.0.0.0 (server1)

                  Error: all DNS servers are invalid

                  No host records (A or AAAA) were found for this DC

                  The SOA record for the Active Directory zone was found

                  The Active Directory zone on this DC/DNS server was found prim

ary

                  Root zone on this DC/DNS server was not found

 

               TEST: Forwarders/Root hints (Forw)

                  Recursion is enabled

                  Forwarders Information:

                    some forwarder addresss (<name unavailable>) [Valid]

 

               TEST: Delegations (Del)

                  Delegation information for the zone: domain.ca

                     Delegated domain name: corp.domain.ca

                        Warning: Delegation of DNS server server1. is broken o

n IP:0.0.0.1

                        Warning: Delegation of DNS server server1. is broken o

n IP:ip

                        Error: DNS server: server1

                        IP:ip

                        [Broken delegation]

 

               TEST: Dynamic update (Dyn)

                  Warning: Failed to add the test record dcdiag-test-record in z

one domain.ca

                  [Error details: 9002 (Type: Win32 - Description: DNS server fa

ilure.)]

                  Test record dcdiag-test-record deleted successfully in zone domain.ca

 

            TEST: Records registration (RReg)

               Error: Record registrations cannot be found for all the network

               adapters

 

         Summary of test results for DNS servers used by the above domain

         controllers:

 

            DNS server: 0.0.0.1 (server2.)

               1 test failure on this DNS server

               PTR record query for the something.in-addr.arpa. failed on the DN

S server 0.0.0.1               [Error details: 1460 (Type: Win32 - Descripti

on: This operation returned because the timeout period expired.)]

               DNS delegation for the domain corp.domain.ca. is broken on IP 0.0.0.1

 

               [Error details: 1460 (Type: Win32 - Description: This operation r

eturned because the timeout period expired.)]

 

            DNS server: 0.0.0.0 (server1)

               1 test failure on this DNS server

               Name resolution is not functional. _ldap._tcp.domain.ca failed on

 the DNS server 0.0.0.0

               [Error details: 9003 (Type: Win32 - Description: DNS name does no

t exist.)]

 

            DNS server: dnsaddress (server1.)

               1 test failure on this DNS server

               PTR record query for the address.ip6.arpa failed on the DNS server server address            [Error details: 1460 (Type: Win32 - Description: This

 operation returned because the timeout period expired.)]

               DNS delegation for the domain corp.domain.ca. is broken on IP ip address

 

               [Error details: 1460 (Type: Win32 - Description: This operation r

eturned because the timeout period expired.)]

 

            DNS server: server address (<name unavailable>)

               All tests passed on this DNS server

 

         Summary of DNS test results:

 

                                            Auth Basc Forw Del  Dyn  RReg Ext

            _________________________________________________________________

            Domain: domain.ca

               server1                    PASS FAIL PASS FAIL WARN FAIL n/a

 

         ......................... domain.ca failed test DNS

      Starting test: LocatorCheck

         GC Name: \\server1.domain.ca

         Locator Flags: 0xe00073fd

         PDC Name: \\server1.domain.ca

         Locator Flags: 0xe00073fd

         Time Server Name: \\server1.domain.ca

         Locator Flags: 0xe00073fd

         Preferred Time Server Name: \\server1.domain.ca

         Locator Flags: 0xe00073fd

         KDC Name: \\server1.domain.ca

         Locator Flags: 0xe00073fd

         ......................... domain.ca passed test LocatorCheck

      Starting test: FsmoCheck

         GC Name: \\server1.domain.ca

         Locator Flags: 0xe00073fd

         PDC Name: \\server1.domain.ca

         Locator Flags: 0xe00073fd

         Time Server Name: \\server1.domain.ca

         Locator Flags: 0xe00073fd

         Preferred Time Server Name: \\server1.domain.ca

         Locator Flags: 0xe00073fd

         KDC Name: \\server1.domain.ca

         Locator Flags: 0xe00073fd

         ......................... domain.ca passed test FsmoCheck

      Starting test: Intersite

         Skipping site Default-First-Site-Name, this site is outside the scope

         provided by the command line arguments provided.

         ......................... domain.ca passed test Intersite

Answer 1

Did you do below? and possibly reboot it?

ipconfig /flushdns, ipconfig /registerdns, restart the netlogon service?

Another issue when a single domain controller is used is described below.

When NLA starts to detect the network location, the machine will contact a domain controller via port 389. If this detection is successful, it will get the domain firewall profile (allowing for correct ports) and we cannot change the network location profile.

If the domain was not found or process failed, NLA will let you to determine which firewall profile will be used, private or public.

When you have a single domain controller there can be a race condition that will cause the network firewall to start up as Public. In this case restarting the NLA (network location awareness) service should solve it.

Also another small one is a domain controller should always have two listings for DNS

1. own static ip (which it has)
2. plus the loopback address (127.0.0.1)

Answer 2

Look here.

Answer 3

I never got to look at the system event Event Source and Event IDs I'm not sure if you got them or not but looks like the shared files are gone now. These ones below are problematic.

                  No host records (A or AAAA) were found for this DC
                  The SOA record for the Active Directory zone was found

Check for non-starting services. Looks like in general active directory domain and DNS services do not start up. A couple of things you could try
https://itsimple.info/?p=876
and the steps in last post found here https://social.technet.microsoft.com/Forums/windowsserver/en-US/832de388-ada3-48b1-a23f-95cce8882797/the-soa-record-for-the-active-directory-zone-was-not-found-windows-2008-domain-dcdiag-testdns-?forum=winserverNIS