DNS is slow to resolve after force removal of a domain controller

domain-name-systemreverse-dns

On a Windows domain I recently had to do a "force removal" of a domain controller.
I was careful to remove all the metadata and did a metadata cleanup.

I also removed all references to the domain controller/dns server I removed on the remaining dns server.

I also moved the fsmo roles and global catalog server role to the new domain controller prior to the force removal.

Now dns is extremely slow to resolve internet websites. If I add the google dns server, to the speed is normal.

Is there a way to further troubleshoot the problem?

Have I missed something in removing the old domain controller?

Best Answer

You also had the removed domain controller as a DNS forwarder for the other name servers. The slowing down was caused by waiting for those queries to timeout before falling back to root hints. (Microsoft's article on Reviewing DNS Concepts explains this in detail.)

This configuration wasn't following the best practices even before removing the server, as it made your whole network dependent on a single DC, that is opposite of the purpose of having multiple domain controllers for redundancy. It worked, but it would have caused this slowing down whenever that DC was down.

DNS with AD DS utilizes Directory-integrated DNS zones for synchronizing the authoritative zones between domain controllers, making them all have the local DNS records already.

  • If you use forwarders, you could use your ISP's DNS servers for the rest of the Internet. Using ISP's DNS servers as forwarders is favorable for getting better answers for services that use different server for different geolocations, if you first make sure those forwarders are actually near you (whereas general open DNS forwarders seldom are).

  • It's also possible to use the root hints instead of forwarders. That makes initial queries for new TLDs a little slower as they don't use a shared huge cache, but are usually cached for a longer time the closer to the root you are. The bigger network you have the better option this is.

Worth reading: DNS hell: The seven deadly sins helps in evaluating what's the best option for you.

Related Topic