DNS not updating Forward Lookup Zones correctly

[CHiLL]

I've been experiencing an annoying issue for a while now. Lets say I re-image a PC using SCCM and give it the same name. This new image will receive a new IP address from DHCP. I have found that our reverse DNS zones are updating their records to the new IP address fine, however the forward lookup zones aren't. It isn't the end of the world, because I can just delete the records manually and run ipconfig /registerdns. I just don't understand why this is happening.

 

DHCP and DNS are installed on our 2x Server 2012 R2 domain controllers (2012 R2 PDC and 2019 DC...same issue has been experienced for years when they were both on 2012 R2).

[mrwoberts]

How do you have your DHCP updating DNS?

This is mine

 

Furthermore, when are your Forward lookup zone set to Scavenge, and Aging values

[CHiLL]

How do you have your DHCP updating DNS?

This is mine

[ATTACH=CONFIG]52794[/ATTACH]

 

Furthermore, when are your Forward lookup zone set to Scavenge, and Aging values

My settings are identical to yours. Scavenging and Ageing are set to 7 days.

[mrwoberts]

Have you specified a member of the dnsadmin group to update the DNS (this is found in the advanced tab). If it has been working you may decide this isn't strictly necessary.

Next you'd want to check who is the owner of the forward and reverse records that are stuck - also check the root permissions (of the Forward, and Reverse folder) to ensure inheritance. Again, you may not have changed these but it's worth double checking.

Edited March 27, 2019 by mrwoberts

[CHiLL]

Have you specified a member of the dnsadmin group to update the DNS (this is found in the advanced tab). If it has been working you may decide this isn't strictly necessary.

Our domain administrator account is already specified.

Next you'd want to check who is the owner of the forward and reverse records that are stuck - also check the root permissions (of the Forward, and Reverse folder) to ensure inheritance. Again, you may not have changed these but it's worth double checking.

If I look at a normal forward DNS record, the owner is set as MACHINENAME$. The Forward and Reverse lookup folders' owner is SYSTEM and inheritance is enabled.

[mrwoberts]

Our domain administrator account is already specified.

 

Personally, I wouldn't do that. It makes more sense to me to create a dns-superhero user, add them to the DNSAdmin group and use those details instead. It's just another place you don't have to remember to change each time you change your DA password, which by the way, may well be the reason.

 

If I look at a normal forward DNS record, the owner is set as MACHINENAME$. The Forward and Reverse lookup folders' owner is SYSTEM and inheritance is enabled.

 

Apologies, I meant to say the owner of the stuck records. Mine are typically set to my dns-superhero, or SYSTEM.

Is the Update associated pointer option ticked on the stuck records.

 

Also, do you have the 'Enabled automatic scavenging of stale records' enabled? It's in the properties windows (advanced tab), of the root of the DNS tree.

 

Failing this, it could be something odd happening from the client side - are these particular devices behaving normally?