[Forum FAQ] DNS Dynamic Update Troubleshooting Guide

Question

As we all known,
DNS Client service and DNS Server services support dynamic updates. With dynamic updates, the DNS client computer is allowed to dynamically register and update this resource
records based on their fully qualified domain name by default. However, in some scenarios,
we may find that
the DNS records are not updated.
To analyze this issue clearly, this kind of issue is divided into two parts in this article:
Non-AD integrated zone with DHCP and DNS unintegrated
AD-integrated zone with DHCP and DNS Integrated
Next, we begin to troubleshoot this issue from the above two classes separately.
Non-AD integrated zone with DHCP and DNS unintegrated
1. Check if Dynamic Updates is enabled or not
If you have encountered this kind of issues, firstly, Please check if dynamic updates is enabled in DNS server or not. You can right-click the domain in the
Forward Lookup Zones, then select Properties. In the dialog, click
General tab and choose Nonsecure and secure
in the Dynamic updates box, then click OK. Please refer to Figure 1 and Figure 2
Figure 1: Check DNS Server Settings-1
Figure 2: Check DNS Server Settings-2
2. Check DNS Suffix
Besides, since all computers register records based on their fully qualified domain name, and the fully qualified domain name is based on the primary DNS suffix of a computer appended to its Computer name. We also need to check the DNS panel of Advanced TCP/IP
settings in TCP/IP properties.
Just as Figure 3, if Register this connection's address in DNS is selected and
Use this connection's DNS suffix in DNS registration
is not selected. This default configuration causes the client to request that the client register the Host resource record and the server register the PTR resource record. In these scenarios, please make sure the primary DNS suffix portion of a computer's FQDN
is the same as the name of the Active Directory domain to which the computer is joined.
Figure 3: Check DNS Client settings-1
You can run “ipconfig/all” at the command prompt to check the Primary DNS suffix. From Figure 4, we can see that the Primary DNS suffix is blank.
Figure 4: Check DNS Client settings-2
To set the Primary DNS suffix, you can follow the steps below (Figure 5):
Right-click
My computer and then click Properties.
In the
System Properties dialog, click Computer Name tab and then click
Change….
In the
Computer Name Changes panel, click More…, then you can type the domain name into the
Primary DNS suffix of this computer and then click
OK.
Figure 5: Set the Primary DNS Suffix
After set the primary DNS suffix, we can see that the Primary DNS suffix is demo.com in Figure 6.
Figure 6: Primary DNS Suffix-demo.com
If both
Register this connection's address in DNS and Use this connection's DNS suffix in DNS registration are selected. You need to check the primary DNS suffix and connection-specific DNS suffix at the same time and make sure that
the connection-specific domain name of this connection is the DNS suffix for this connection appended to the computer name. In the picture above, we can see that the Primary
DNS suffix and Connection-specific DNS suffix are the same.
AD-integrated zone with DHCP and DNS Integrated
In some cases,
this issue may happen when the DNS zone is AD-integrated and DHCP server is configured to register and update the A resource records and PTR records on behalf of the DHCP-enabled clients.
1. Check if secure dynamic updates is enabled or not
As everyone knows, DNS update security is available only for zones that are integrated into Active Directory Domain Services (we
can see the difference from Figure 7 and Figure 2). Since secure dynamic updates can prevent unauthorized computers from overwriting existing names in DNS, generally, we recommend
using only secure dynamic updates for AD-integrated zone.
For AD-integrated zone, we can check if secure dynamic updates is enabled in DNS server or not firstly.
You can right-click the domain in the Forward Lookup Zones, then select
Properties. In the dialog, click General tab and choose
Secure only in the Dynamic updates box, then click OK. Please refer to Figure 7.
Figure 7: Check DNS Server Settings-2
2. Check the DNS configuration and options settings on DHCP server
We need to make sure
that DHCP server is configured to register and to update client information with its configured DNS servers. You can check by right-clicking the
IPv4 under your domain and choosing DNS in IPv4 properties.
By default,
the
Enable DNS dynamic updates according to the settings below and
the Dynamically update DNS A and PTR records only if requested by the DHCP clients box is checked. 
You can also select Always dynamically update DNS A and PTR records box so that the DHCP server
always registers and updates client information with its configured DNS servers. (Figure 8)
Figure 8: DHCP Server Settings
In addition, you need to check that the configuration 006 DNS server option in DHCP option is correct.
You can check that by clicking
Server Options in DHCP console. If the setting is incorrect, you can right-click the option and then choose
Properties, then you can remove the wrong DNS server and add a correct one. (Figure 9)
Figure 9: Check DHCP Options
3.
Check if the DHCP server is added to the DnsUpdateProxy security group
Furthermore, as the DHCP server becomes the owner of the name since the DHCP server performs a secure dynamic
update on that name, only that DHCP server can update the name. We would make sure the DHCP server is available. If the DHCP server fails, even other DHCP servers are online, they still have no right to update the client’s record because the other DHCP
server are not the owner of the client name.
To solve this, it is necessary to add the DHCP server to the DnsUpdateProxy security group in AD. You can follow the steps below to achieve that: (Figure 10 and Figure 11)
Open ADUC, click
Computers under your domain.
Right-click your DHCP server and select
Add to a group tab.
Enter
DnsUpdateProxy in the object name box and click
Ok.
Figure 10: Add DHCP Server to the DnsUpdateProxy security group – 1
Figure 11: Add DHCP Server to the DnsUpdateProxy security group – 2
After that, you can find that the DHCP server (In this demo, the DHCP server is W2K12R2) is a member of the DnsUpdateProxy group. (Figure 12)
Figure 12: DHCP server is a member of the DnsUpdateProxy group
4.
Check the
Credentials configuration for DNS update
Furthermore, if
a domain controller is running on the same host as the DHCP server and secure dynamic DNS update has been configured, you need to configure
Credentials for DNS update.
You can
open DHCP console tree, right-click
IPv4 and then click Properties. In the IPv4 Properties
dialog, click Advanced, click
Credentials, type the credentials that the DHCP server supplies when registering names using DNS dynamic updates, and then click
OK. (Figure 13)
Figure 13: Configure DNS dynamic update credentials
More information:
DHCP, Dynamic DNS Updates , Scavenging, static entries & timestamps, the DnsUpdateProxy Group, and DHCP Name Protection (Published by Ace Fekay, MVP)
http://msmvps.com/blogs/acefekay/archive/2009/08/20/dhcp-dynamic-dns-updates-scavenging-static-entries-amp-timestamps-and-the-dnsproxyupdate-group.aspx
Integrating DHCP with DNS
http://technet.microsoft.com/en-us/library/cc771732.aspx
Using DNS servers with DHCP
http://technet.microsoft.com/en-us/library/cc787034(v=ws.10).aspx
How to configure DNS dynamic updates
http://support.microsoft.com/kb/816592/en-us
Keyword: Dynamic Update, Troubleshooting 
Please click to vote if the post helps you. This can be beneficial to other community members reading the thread.

Answer 1

I have created one STATIC DNS Entry, for Example "ROSE" and
1.                   Open
the DNS snap-in.
2.                   Right
click the individual record (ROSE) and open the Properties dialog.
3.                   Uncheck
the Delete this record when it becomes stale option
and click OK
For
the moment the time stamp will show as BLANK
Then
I logged in to server "ROSE" and restarted DHCP Client
Service on server or restarted server, the time stamp is automatically setting as current date and "DELETE THIS RECORD WHEN IT BECOME STALE" check box also selected automatically
and gets deleted after a week or so when the scavenging runs
Is
there any way to avoid the static entries become dynamic automatically. 
Domain Controller or DNS OS is Windows server 2003 R2 Standard Edition SP2
Thanks & Regards
Dinesh Cholekkavil