samba - Feb 2022 - Member join, dns issues

They *are* the 3rd level domain masters.

So they're authoritative for
AD.SOMEDOMAIN.COM.

But we also have records in
SOMEDOMAIN.COM, and the AD servers are NOT authoritative for that zone.

All DNS lookups will be to the BIND servers, not the AD servers - but we'll
forward all queries for *.AD.SOMEDOMAIN.COM to the AD servers.

The IP blocks we use are not allocated-to/owned-by the AD servers. (And
likely never will be.)


On Thu, Feb 24, 2022 at 10:03 AM Rowland Penny via samba <
samba at lists.samba.org> wrote:
> On Thu, 2022-02-24 at 09:54 -0800, Greg Sloop <gregs--- via samba
> wrote:
> > How important is the reverse, PTR record?
> >
> > The zones for the IP blocks aren't "owned" by the Samba
DC, but by
> > our
> > internal BIND/DHCP servers.
>
> The AD DCs should be the dns masters, this could be your problem.
>
> Rowland
>
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On Thu, 2022-02-24 at 10:30 -0800, Greg Sloop <gregs--- via samba
wrote:
> They *are* the 3rd level domain masters.
> 
> So they're authoritative for
> AD.SOMEDOMAIN.COM.
Good
> 
> But we also have records in
> SOMEDOMAIN.COM, and the AD servers are NOT authoritative for that
> zone.
The AD DCs shouldn't be authoritative for anything outside the AD dns
domain.
I presume that all the 'SOMEDOMAIN.COM' records have nothing to do with
your AD, if not, what are they ?
> 
> All DNS lookups will be to the BIND servers, not the AD servers - but
> we'll
> forward all queries for *.AD.SOMEDOMAIN.COM to the AD servers.
That is a good accepted practice.
 
> 
> The IP blocks we use are not allocated-to/owned-by the AD servers.
> (And
> likely never will be.)
That could be a mistake, perhaps you should have used a different block
(10.0.0.0/24 instead of 192.168.1.0/24).

Rowland