Windows Server 2003 DCDiag error message "delegation is broken for foo.com.foo.com on dns server"

Question

It started as a simple diagnostic: dcdiag /c

when it ran it gave me the following error from the DNS portion of the DCDIAG test

delegation is broken for foo.com.foo.com on dns server on dns server 192.168.1.1

and

delegation is broken for foo.com.foo.com on dns server on dns server 192.168.1.2

Those IP's correspond to the two domain controllers on the network.

So now I am left wondering. What is a broken delegation and more importantly, how do I fix it?

Solution 1

The delegation test checks for broken delegations by ensuring that all NS records in the Active Directory domain zone in which the target domain controller resides have corresponding glue A records.

Try:

1) Setup DNS servers in TCP/IP config for your servers as folowing: own IP as primary DNS, other DC as secondary DNS (check http://support.microsoft.com/kb/825036 for details). Never use ISP (or other external) DNS as DNS server at any DC in TCP/IP settings

2) ipconfig /registerDNS on both servers

3) netdiag /fix

Solution 2

For me, someone had simply added an A HOST record under the wrong place.

IE if your domain was Test.Microsoft.internal, someone had created a sub domain in DNS called "internal", with a sub domain called "microsoft", and within that a sub domain called "Test" - hence you then get [computername].test.microsoft.internal.test.microsoft.internal The DCDIAG dns test will then give you the "delegation is broken for ..." error for each and every Name Server for your DNS zone.

E.G. This was in my tree view in DNS:

Test.Microsoft.internal
       +_mcsdcs
       +_sites
       +_tcp
       +_udp
       -internal
              -microsoft
                     -test

Took me a while to figure this out, as it's somewhat misleading. Deleting the emboldened domains resolved the error message. Otherwise it wasn't really that important, but the error makes it sound like it is!

Comments

[MikeJ]

I tried your suggestion but it did not resolve the problem :(. I suspect there is an issue in how the DNS servers themselves are configured on the PDC and BDC. I am sure it is something fundamentally simple, but for the life of me I dont know what I am missing to resovle the issue.