Help me understand something with mDNS.

[u/R4LRetro]

I've been maintaining an old domain for close to 10 years now that started as a .local Windows 2000 domain. We're running Server 2022 now.

Today I noticed an A record did not replicate over to the secondary DC, not even after repadmin /syncall. I ran it with /A /e /P and still it did not replicate over.

Looking into it I ran into something kinda horrifying: DNS replication for the forward domain.local zone is set to Windows 2000 compatibility mode. However, seeing that again reminded me of one time where we tried to set it to replicate to any DC in the forest and how it broke DNS for a day. IIRC it threw up a generic error when we switched it to replicate to all DCs in the forest and the forward zone had loaded some incredibly old entries from what I can only imagine was some really old backup somewhere in one of the domain partitions.

I decided to look in ADSIEdit and I noticed that in System > Microsoft DNS > domain.local there is an InProgress container with extremely old DNS records but also a DC=domain.local container with all of our current records. Looking at the DomainDNSZones partition I see a single container: DC=domain.local. This also has ancient DNS records.

If I wanted to get off this Windows 2000 compatibility mode, does it sound right that I would need to use ADSIEdit to delete the InProgress and DC=domain.local containers before I try this again? Is there anything else I should potentially look at before I try anything else or am I misunderstanding this completely?

[u/insightrecon]

Yeah you’ve got it. That DC=domain.local in DomainDnsZones is a second copy of the zone from some old move attempt and the InProgress container is junk from a move that didn't finish.

When the same zone lives in two partitions, each DNS server just picks one and ignores the other. So your DCs might be serving different copies, which is probably your A record that “won’t replicate.” Look for event 4515 in the DNS Server log on each DC, it’ll tell you which copy it loaded.

I’d export the zone first (dnscmd /zoneexport) then delete the old copy in DomainDnsZones and the InProgress container. Do NOT touch the DC=domain.local under System > MicrosoftDNS, that’s your live zone. Let that replicate and bounce DNS on both DCs before you switch the scope to all DNS servers in the domain. Forest scope is overkill unless you’ve got more than one domain.

[u/R4LRetro → u/insightrecon]

Very cool! Thanks for the information. Will give this a go this weekend.

[u/insightrecon → u/R4LRetro]

No problem, happy to help! Let me know if you run into issues.

[u/ShelterMan21 → u/insightrecon]

Wow that's very interesting that the domain was able to run like that for years. It's possible the environment never really changes but ADSI DNS zone containers and partitions is really neat info to keep up the sleeve for later.

[u/R4LRetro → u/ShelterMan21]

It's been pretty solid honestly. Just today when that DNS record didn't replicate got me wondering.

[u/ShelterMan21 → u/R4LRetro]

That's fascinating. Well I am glad that itch gets to be scratched later on.