Why can't I replicate DNS zones to non-DC DNS servers?

Question

I've installed Windows Server 2008R2 Enterprise Edition with SP1 on two computers:
1) My primary domain controller.
2) A dedicated DNS server.

My DNS server is not a domain controller, but it has been joined to the domain successfully.

However, the main forward lookup zone does not replicate to the DNS server (presumably because it is not a domain controller).

When I open the DNS Manager on my domain controller, and open the replication settings for this zone, I see this:

There are no options available to replicate to all DNS servers, regardless whether they are domain controllers.
1) Why can't the zone be replicated to all DNS servers?
2) What can I do to make this zone replicate to my dedicated DNS server?
3) Can I safely resolve this by creating this forward lookup zone on my dedicated DNS server, and configuring this new zone to replicate back to my domain controller?

Thanks in advance!

Solution 1

AD-integrated DNS zones (the kind that replicate via AD) can only exist on domain controllers, as their data source is a directory partition that's read from the local system - directory services replication can't happen to a system that doesn't have directory services available.

A non-DC DNS server's zones are stored locally on the individual system - you can use zone transfers (secondary zones) to get copies of zones on another system, but you can't make changes on that system - this might not be the kind of behavior you're interested in.

Solution 2

Why can't the zone be replicated to all DNS servers?

When the zone is AD integrated, then the zone is stored in the AD. A stand alone machine doesn't have a copy of the AD.

What can I do to make this zone replicate to my dedicated DNS server?

Adjust the zone transfer permissions on the zone, and setup your stand-alone server as a secondary, with one or many of your AD server as the master.

You can either explicitly list your server on the domain controller that are allowed to tranfer, or choose the less secure option and just permit any machine to do zone transfers.