I have a several Windows Server 2008 R2 DC/DNS servers locally, RODC's at the remote office, and a Windows Server 2012 DC/DNS server on Azure with a VPN tunnel established.
Earlier today I moved a webserver, changed the DNS records on one of the local DNS servers, and updated at the registrar. Everything worked as expected.
Then weird issues started popping up, some people being directed to the wrong server, others to the correct one.
After troubleshooting, I checked the local DNS server again and the records were still correct, until I hit refresh, and the old A-Records popped up in conjunction with the new ones.
The way these records are set up, is a forward lookup zone with one static A record using the parent domain for each zone.
So there ended up being two A-Records with different IP's for the URL's that I had changed earlier in the day, and the old records showed back up in DNS manager when I refreshed the screen. (I had checked several times previously without refreshing)
Fortunately this only affected internal users and not all of them at that, all external users were unaffected because the public DNS records are published through a registrar (GoDaddy, independent so unrelated).
What happened? And how can I prevent this from happening again?
Best Answer
Nope, that's not what happened. Assuming you're talking about AD Integrated zones, DNS records are objects in AD. Objects have a USN which is essentially a number that increments whenever a change to that object is made. If your tunnel "blipped" the USN would be incremented on your on-prem DCs and not on your Azure-hosted DC. This means that when it came back online, it would see that it had an older copy of the record and update inbound. It wouldn't replicate the old record outbound.
As to why it happened, it's really next to impossible to say without getting deep into your environment.