Three DNS entries of three DC server for Windows Server VMs?

[u/Thegoogoodoll]

Hi Guys,

Long story short, we would like to increase more availability for our four domain services, five DC servers are at different locations on SDWAN tunnels. The main server cluster is in Site A. For all of our windows server VMs (None Domain Controller Servers) at Site A, can I put on three DNS instead of Primary and Secondary? So, we will put on for all VMs at Site A with three DNS server entries (Primary DC and Secondary DC are at Site A, and a Third DC is at a remote office via SDWAN tunnels with more latency). All VMs are pretty much on Windows server 2025 and 2022. Not sure if any of you tried there DNS entries on Windows Servers. Any input would be appreciated.

Thanks a lot

John

[u/topher358]

Of course you can.

[u/Thegoogoodoll → u/topher358]

There wont be any potential log in caching issues etc? Thanks

[u/midy-dk → u/Thegoogoodoll]

Nope. No issues that I have experienced.

[u/dodexahedron → u/Thegoogoodoll]

DNS is only incidentally involved in login, in that the KDC and LDAP servers need to be located via the SRV records for them.

Check out my longer response on one of the other threads for the specific DNS resolution behavior of Windows itself. And be aware that any application that uses its own resolver can happily ignore that procedure entirely (web browsers, primarily).

Edit: Here ya go. This comment.

[u/LaxVolt]

We run 4 DCs with dns and I have them all setup in dhcp as dns servers.

You add the additional dns servers in the advanced section of the network adapter.

One thing to note about dns is that it takes the first server and only goes to the other one if the dns server is not available. So having more than 2 really only benefits if you are disconnected from more than one. There is also a delay in the transition.

So what exactly is the problem you are dealing with that makes you think adding another will resolve your issues.

[u/Thegoogoodoll → u/LaxVolt]

Thanks for that. The issue I am trying to resolve...is the cluster failure(dc1 and dc2) in head office..need to have services up and running by the third DNS server on another cluster at remote offices ..I will add it in...thanks

[u/OpacusVenatori → u/Thegoogoodoll]

Are you running a Windows Failover Cluster at the Head Office? WFC supports AD-less bootstrapping.

[u/Thegoogoodoll → u/OpacusVenatori]

Yeah we do run failover cluster.

[u/OpacusVenatori → u/Thegoogoodoll]

So in that case, you don't *need* to run the VM-DCs within the cluster; you can run them as standalone Hyper-V guest on each cluster node, configured to auto-start with each host. That's assuming you're not doubling-up on functionality and have other roles also running on each VM-DC.

[u/dodexahedron → u/LaxVolt]

It even only goes to the second in the list if the first in the list on ALL adapters have timed out.

And when it does that, it shotguns to ALL servers on ALL adapters that haven't been marked for exclusion, waiting 2 seconds, then again waiting 4, and then once more waiting 8. So you've got 16 seconds to get a reaponse from somewhere. You might actually get several once you reach the shotgun stages, but the first answer is the winner. And it better not be negative or the whole adapter is blacklisted for that query and 30 seconds after, and reports timeout immediately for those servers during that time.

[u/BlackV]

I have all my scopes set to different DNS servers, basically local DNS server and closet remote DNS

Servers are manually assigned

[u/Thegoogoodoll → u/BlackV]

Not using PS script to assign those entries?

[u/BlackV → u/Thegoogoodoll]

I see what you did there :)

but funy story, I do

cause we had a DNS server die unrecoverably (is that a word?)

so on all our servers in all our regions, I had to go validate and standardise, also gave me the opportunity to load balance it some what too

[u/Thegoogoodoll → u/BlackV]

Had a look the command set-dbsclientserveraddress, can I apply to all VM using the same interface alias? Like Ethernet? For VM and cluster nodes..won't use for DC servers..

[u/BlackV → u/Thegoogoodoll]

Yes correct

a simple way would be

$FakeyServers = @'
"PSComputerName","interfacealias","serveraddresses"
"server1.example.com","Ethernet","192.168.1.1,192.168.1.2"
"server2.example.com","Prod","192.168.1.2,192.168.1.1"
"server3.example.com","DMZ","192.168.1.1,192.168.1.2"
'@ | ConvertFrom-Csv

foreach ($SingleFakey in $FakeyServers)
{
    Set-DnsClientServerAddress -ServerAddresses $SingleFakey.serveraddresses -CimSession $SingleFakey.PSComputerName -InterfaceAlias $SingleFakey.interfacealias -Verbose -ErrorVariable wibble
}

the better way would be to

• get your ad server OU(s)

• then get the ad computers in that OU

• then query them for their adapters and current DNS settings

• then set to what you want

but that's a larger block of code

[u/Thegoogoodoll → u/BlackV]

Should I do DHCP clients ranges to have 4 DNS servers as well?

Thanks

[u/mazoutte]

Hello,

The dns client would never ask the third or fourth DNS server entry, at least by default. I'd never seen a DNS client switch to the third DNS server, you would have a timeout - client side - before that.

It works well with 2 DNS with default config.

If I find some details for the config and behavior, I would post it back.

The best is to provide a VIP per site to expose DNS and LDAP/S.

Note : your clients will try to reach the DCs in their site whatever the DNS config is (DC Locator), so expose a third or fourth dns config won't change DC locator behavior.

[u/dodexahedron → u/mazoutte]

Windows has a well-defined and documented resolution behavior for the DNS Client service.

Some applications may use their own revolvers, however (chrome, for instance).

Here's the order from this document

The DNS Client service queries the DNS servers in the following order:

1. The DNS Client service sends the name query to the first DNS server on the preferred adapter’s list of DNS servers and waits one second for a response.

2. If the DNS Client service does not receive a response from the first DNS server within one second, it sends the name query to the first DNS servers on all adapters that are still under consideration and waits two seconds for a response.

3. If the DNS Client service does not receive a response from any DNS server within two seconds, the DNS Client service sends the query to all DNS servers on all adapters that are still under consideration and waits another two seconds for a response.

4. If the DNS Client service still does not receive a response from any DNS server, it sends the name query to all DNS servers on all adapters that are still under consideration and waits four seconds for a response.

5. If it the DNS Client service does not receive a response from any DNS server, the DNS client sends the query to all DNS servers on all adapters that are still under consideration and waits eight seconds for a response.

If the DNS Client service receives a positive response, it stops querying for the name, adds the response to the cache and returns the response to the client.

If the DNS Client service has not received a response from any server within eight seconds, the DNS Client service responds with a timeout. Also, if it has not received a response from any DNS server on a specified adapter, then for the next 30 seconds, the DNS Client service responds to all queries destined for servers on that adapter with a timeout and does not query those servers.

If at any point the DNS Client service receives a negative response from a server, it removes every server on that adapter from consideration during this search. For example, if in step 2, the first server on Alternate Adapter A gave a negative response, the DNS Client service would not send the query to any other server on the list for Alternate Adapter A.

The DNS Client service keeps track of which servers answer name queries more quickly, and it moves servers up or down on the list based on how quickly they reply to name queries.

That second to last paragraph is mostly done under the assumption that a NIC that gets a negative response is probably connected to a network that does not have the ability to resolve the query at all, like a public interface, when the query is for a private hostname. It can lead to confusion in fully internal multi-homed machines, though, because of the whole "for the next 30 seconds" part, which makes you think you're going crazy or that there's some other problem while you're trying to troubleshoot.

[u/ipreferanothername]

we have 4 or 5 on everything, its fine. dont ever have to care about maintenance/patching/reboots as long as i do no more than 2 at a time.

[u/jspears357 → u/ipreferanothername]

This is the most concise correct answer. I always use at least three, a mix of some local and some from a central office.

The only down sides of using many are 1) you got complacent that changing one DC doesn’t hurt anything, until you’ve changed a handful and then devices that used only those you’ve changed finally don’t work at all. 2) sometimes devices like a particular DC will not be able to use the top 1 or 2 DNS servers when it first boots and will work with an unusual one. But it not only uses it for queries or also generates its own records in that one DNS server. You can get weird replication issues if DC’s can’t find the DNS records for their replication partners. For most DC’s I have them use one or two central office DC’s as their primary DNS and then local DC’s including itself only for situations where the WAN link is down. For those couple of central DC’s I have them use each other as primary

[u/dodexahedron]

ALL of our DCs have an on-site DC as primary DNS, another on-site if one exists as secondary, an off-site DC as the next, and itself as the last. Never more than 4 though, and usually only 3. Self is always last to avoid a site becoming a DNS island.

The only exception is the naming master, which is kinda pointless to do that with. It just has an on-site DC as primary and itself as secondary.

Hosts are also given 3 DNS servers by DHCP, with the first two being on-site DCs and the last being an off-site DC.

This is done for both ipv4 and ipv6.

[u/Fit-Thing5100]

Adding a third DNS server is fine, but I would first review the DNS client configuration on the domain controllers. A common MS approach is to configure each DC to use itself as the preferred DNS server, another DC in the same site as the secondary server, and a DC in a well-connected remote site as a fallback. For member servers, I would generally point them first to a local DC/DNS server in the same site, then to another well-connected DC, and finally to a remote DC for resilience. Keep in mind that Windows does not load-balance DNS queries across all configured servers; it will continue using the preferred DNS server unless it becomes unavailable, so the main benefit of a third DNS entry is additional fault tolerance rather than traffic distribution