New Domain Controller with DNS in Windows has forwarders setup

Question

I just installed a new Windows 2012 R2 domain controller. I was looking in the DNS Server, and there were two DNS Forwarders setup, which were other domain controllers. "Forwarders are DNS servers that this server can use to resolve DNS queries for records that this server cannot resolve"

I'm curious though, how was it already populated with other server names? Is this default set somewhere in Active Directory?

edit: Screenshots of where I'm referring to

Solution

This does appear to be expected behavior, and it occurs when you create your domain controller.

DNS forwarders are auto-populated when the domain controller is promoted, according to a set of rules that's ill-documented by Microsoft, but that the fellow at the linked page seems to have enumerated nicely. I checked, and the auto-population behavior in Server 2012 R2 seems to be unchanged from Server 2008 R2. The only official word from Microsoft that I've been able to find on the subject is this Technet blog post.

It does makes sense, at least as far as copying external DNS forwarders - you presumably would want the same ones for all your domain controllers, or at the very least, would want all your domain controllers to have some external forwarder, so that your clients can perform DNS lookups for external domains.

Comments

[Brett G]

These are DCs in our domain, yes. Honestly, I'm not exactly sure why this was setup this way.... we don't need any forwarders. However, more of my question is why a virgin server brought in this setting after I promoted it.

[HopelessN00b]

I applaud the effort in posting a screenshot, but you did kind of redact everything that would be useful in it.

[kralyk]

There are AD integrated conditional forwarders, but I've not seen AD integrated normal forwarders. These are set per DNS server and not replicated that I'm aware of. So I'm not sure how you are seeing this, or even why the DCs would even be in there since it doesn't make much sense to forward a DNS request to another DC that will give the same answer as the existing DNS server.

[joeqwerty]

I'm with thecleaner. Conditional Forwarders can be replicated with AD but I've never seen this with Forwarders. It could be that I've never looked so have never notice it, but it seems odd.

[joeqwerty]

As for forwarding to other DC's: I've seen that in secured environments where only specific DC/DNS servers are used to forward external queries, so that seems OK to me.

[kralyk]

Good insight, strange that I've never noticed it myself, but I also just use 8.8.8.8 and the root hints for all so I probably saw it and figured I'd already set it. :)

[HopelessN00b]

@TheCleaner It's something I had to think about.. and when I did, I realized it's always "just worked", and because it always "just worker" with no input from me, something I'd never thought about before. :)