DcDiag: "Warning: The Active Directory zone on this DC/DNS server was not found (probably a misconfiguration)" meaning?

Question

Does this mean there is no Forward Lookup Zone by the name of the domain (say domain.local) in DNS? I only have the log of dcdiag, not the actual machine, so I cannot check.

Later it says:

Matching A record found at DNS server %own IP%: dc2.domain.local

So dcdiag says there is a record in a zone that is not there? Or does dcdiag not notice when a record is found using a forwarder?

UPDATE: The DNS server has two DNS servers configured as forwarders.

Solution

EDIT: changed answer, because partly it was nonsense and partly it didn't apply.

Possibly the server has only a stub zone, which can include A records. The AD zone includes also structures like "_msdcs", "_sites", "_tcp", "_udp", "domaindnszones" and "forestdnszones", which are necessary to find the directory services in the AD.

Also the A record could be served by the forwarders.

EDIT: When you have access to the server, check for the zone being primary, and having the above mentioned SRV entries.

You can read here in more detail than I'm able to explain how DNS is used for AD, an whats needed.

Comments

[boston]

The NIC has only itself (127.0.0.1) configured as DNS server. What do you mean by:"When DcDiag searches for the zone, it does so possibly not by querying for a name."?

[boston]

OK to make sure I got this right. You say that dcdiag might report that the "Active Directory zone on this DC/DNS server was not found" because it is missing the specific subfolders, but the zone exists as a stub with A host record for the DC?

[knitti]

a stub zone is a type of zone in MS DNS, which is not authoritative. I only suspect thats the case with your server, I don't really know. I also don't know whether these folders have to be absent, but they aren't usually there in a stub zone.