DNS performance issues with secondary domain controller

[mikkydoos]

Hi all,

 

Need a little help please......

 

I've got 2 domain controllers, both DHCP, DNS ----> DC1 (2012), DC2 (2016). DC1 is authoritative and FSMO.

 

If I take DC1 down I get horribly slow DNS performance ---> internet and local.

 

In DHCP both DNS servers (DC's) are listed, and in DNS I also have both and a few forwarders listed - our ISP's and Google.

 

 

Im sure this makes no difference to clients, but the networks properties on both DC's point to each other, then themselves.

 

 

 

In the event that DC1 is down, is it that a client must be rebooted in order for it to connect to DNS from DC2 first via its DHCP host?

 

Any ideas?

 

 

 

Cheers in advance

Edited September 25, 2017 by mikkydoos

[Steve21]

Best practice is 2nd DC is primary option, own IP (not loopback) is secondary option.

 

Shouldn't need to restart anything, assuming all clients have both set as options via DHCP etc?

 

Also I assume you have it setup to allow both DHCP to update zones/replicate DNS zones etc?

 

Steve

[mikkydoos]

Best practice is 2nd DC is primary option, own IP (not loopback) is secondary option.

 

Shouldn't need to restart anything, assuming all clients have both set as options via DHCP etc?

 

Also I assume you have it setup to allow both DHCP to update zones/replicate DNS zones etc?

 

Steve

 

Yep but still slow.

[Steve21]

How slow do you call slow? Will take slightly longer as it's timing out first one but shouldn't be that noticeable.

 

Load up https://www.grc.com/dns/benchmark.htm and run the test on the local servers when the main one is down, and post the tabular data page bit for your local ones.

 

Edit - Just to confirm I mean this bit:

 

10. 0. 1.zxc | Min | Avg | Max |Std.Dev|Reliab%|

----------------+-------+-------+-------+-------+-------+

+ Cached Name | 0.000 | 0.000 | 0.001 | 0.000 | 100.0 |

+ Uncached Name | 0.014 | 0.053 | 0.262 | 0.070 | 100.0 |

+ DotCom Lookup | 0.014 | 0.014 | 0.015 | 0.000 | 100.0 |

---<-------->---+-------+-------+-------+-------+-------+

DC1

Local Network Nameserver

 

 

10. 0. 0. zxc | Min | Avg | Max |Std.Dev|Reliab%|

----------------+-------+-------+-------+-------+-------+

+ Cached Name | 0.000 | 0.000 | 0.001 | 0.000 | 100.0 |

+ Uncached Name | 0.014 | 0.056 | 0.255 | 0.072 | 100.0 |

+ DotCom Lookup | 0.014 | 0.014 | 0.016 | 0.001 | 100.0 |

---<-------->---+-------+-------+-------+-------+-------+

DC2

Local Network Nameserver

 

 

10. 0. 1.zxc | Min | Avg | Max |Std.Dev|Reliab%|

----------------+-------+-------+-------+-------+-------+

+ Cached Name | 0.000 | 0.000 | 0.000 | 0.000 | 100.0 |

+ Uncached Name | 0.013 | 0.058 | 0.264 | 0.071 | 100.0 |

+ DotCom Lookup | 0.013 | 0.014 | 0.015 | 0.000 | 100.0 |

---<-------->---+-------+-------+-------+-------+-------+

DC3

Local Network Nameserver

 

Steve

Edited September 25, 2017 by Steve21

[Michael]

I presume both servers are patched? The September '17 updates are absolutely fine.

 

The other possibility are VLANs or some other configuration? Are you using teamed NICs?

[mikkydoos]

@Michael Yes all patched. No VLANS. Both DCs are VMs so technically yes - the hosts are on teamed NICs. Issue is the same when they are on the same host.

 

@Steve21 I ran that rather handy util

 

Speeds reported were negligible. Well under a second for both DC's.

 

 

Something isn't configured correctly somewhere - spotted that Smoothwall loses kerberos authentication too - so it isn't picking up the 2nd DC.

 

For DNS timeouts, MS say:

 

 

(Numbers are Time (seconds since start))

 

Action:

0 Client queries the first DNS server of the list

1 If no response is received after 1 second, client queries the second DNS server of the list and at the same time queries again the first DNS server

3 If no response is received after 2 more seconds, client queries again the first DNS server

7 If no response is received after 4 more seconds, client queries again the first DNS server

9 If no response is received after 2 more seconds, client stops querying

 

 

When mine do resolve it could be 8-10 seconds. Seems the above states that the 2nd DC is only queried once anyway.

 

DHCP 1

 

DHCP 2

Edited September 25, 2017 by mikkydoos

[Steve21]

Did you check the last tab of the util too (Conclusions)? For the recommendations part. Checks about the standard setup for replications, Speed of links, etc etc

 

In regards to the 1 try on 2nd DC, 1 should be enough for a response though as it's only if it doesn't get a reply back it ignores it. Shouldn't ever time out really unless you're dropping stuff somewhere else too

 

Steve

[mikkydoos]

The benchmark conclusion passes with every check passed. Must be something in my DHCP but I cant find what.

 

Both DC's pass dcdiag and dcdiag /test:dns without error.

[Steve21]

You tested the replication for the failovers between them? Just in case it's not passing something when one goes offline

 

Steve

[mikkydoos]

Yep. They replicate fine.

 

EDIT: sorry just re-read. I'll have to wait for out of hours to do some proper testing. Internet goes down or slows to a halt when I take DC1 down.

Edited September 26, 2017 by mikkydoos

[Steve21]

One thing I did notice in your scope settings, Do you not have 015 set anywhere? Or do you have it setup by suffix on clients? Also assume both are on IP helpers list?

 

Steve

[mikkydoos]

015 isn't set in my scope options. I assume that by virtue of a machine being joined to a domain it will add its own suffix. No ??

 

EDIT: As in all my DNS A records show the FQDN of each machine.

 

 

Also no IP helpers here due to no multiple VLANs.

Edited September 26, 2017 by mikkydoos

[Steve21]

Ah ok that should be fine then, and global catalogs enabled on all etc? FMSO Roles split or all hosted on one? DHCP scopes split or hot/warm?

 

Steve

[mikkydoos]

FSMO is on DC1.

 

DHCP failover - DC2 in hot standby, replicating leases with DC1 fine

 

Both are global catalogue servers.

[mikkydoos]

With the help of Smoothwall support I managed to get our proxy to talk to the 2nd DC by adding conditional forwarders.

 

Still yet to test the local performance but at least that's one step forward.

 

Local resolution seems to have improved since the other day but still to test properly.

Edited September 28, 2017 by mikkydoos