Primary DNS resolution slow if PDC role DC is down

Question

Hello,
In my environment I'm running purely Windows Server 2012 in a two site environment.  I run a single domain infrastructure with my main site that has 2 domain controllers (one has all FSMO roles), and a second site which has a single domain controller.
 I've been looking all over the forums for a related topic, but haven't read something anything that fits my scenario.  Basically what happens is, if the DC that has FSMO roles (specifically PDC) goes offline, or if I were to turn the DNS service
off, all devices would take forever for DNS resolution.  Another scenario (which is essentially the same) is if the VPN tunnel between the two sites goes down, all clients at site 2 would take awhile for DNS resolution.  If those clients launch their
browser any website they go to takes 5-10 seconds to load.  They could reboot their PC, and do ipconfig /flushdns, and even though those clients DNS settings point to the DC at site 2 as primary DNS, it takes awhile.  As soon as the PDC server is
restored everything is back to normal.  Quite frequently the VPN tunnel will go down leaving very slow responses at site 2.  Oddly enough is, if the tunnel were to go down, and I logged into the DC at site 2, if I were to ping various domains the
response would take 5 or so seconds.  Is this normal to occur?  If not, how could I possibly remedy this?  My assumption is that, if the primary DNS were to go down, or in this case the PDC server goes down, one of the secondary servers would
kick in.  I appreciate any light you can shed on this issue.
Ken

Answer 1

I agree with Meinolf. It's not always the DNS or PDC or whatever DC is in question's, fault. A lot of it is due to the client side resolver algorithm. Here's more specifics on how the whole process works - and note that this applies to all operating systems,
Windows, Linux, Unix, BEOS..... because they all follow the RFCs defining how client side resolvers work.
This blog discusses:
WINS NetBIOS, Browser Service, Disabling NetBIOS, & Direct Hosted SMB (DirectSMB). Troubleshooting the browser service.
Client side resolution process chart.
The DNS Client Side Resolver algorithm.
If one DC or DNS goes down, does a client logon to another DC or use the other DNS server in the NIC?
DNS Forwarders Algorithm and multiple DNS addresses (if you've configured more than one forwarders or more than one IP in the NIC's DNS list)
Client side resolution process chart
Published by Ace Fekay, MCT, MVP DS on Nov 29, 2009 at 10:28 PM  1764  1
http://msmvps.com/blogs/acefekay/archive/2009/11/29/dns-wins-netbios-amp-the-client-side-resolver-browser-service-disabling-netbios-direct-hosted-smb-directsmb-if-one-dc-is-down-does-a-client-logon-to-another-dc-and-dns-forwarders-algorithm.aspx
DNS Clients and Timeouts (Part 1 & Part 2), karammasri [MSFT] Dec 2011 6:18 AM
http://blogs.technet.com/b/stdqry/archive/2011/12/02/dns-clients-and-timeouts-part-1.aspx
http://blogs.technet.com/b/stdqry/archive/2011/12/15/dns-clients-and-timeouts-part-2.aspx
DOMAIN NAMES - CONCEPTS AND FACILITIES - Dicusses local resolvers.
http://tools.ietf.org/html/rfc882
=============
To add on how the client resolver picks a nameserver, below is a link to a discussion that points out the following - and please note, the operative point in the first bullet point indicates "equivalent," meaning that all DNS servers you enter into a NIC,
must all reference the same exact data, so you can't mix nameserver with different data and expect the client to try all of them.
•by RFC, all nameservers in a zone's delegation are equivalent
•they are indistinguishable to the client
•clients are allowed to choose the NS to query with whichever policy they wish
•if any picked server fails to respond (e.g. "ns3"), then the next server is picked among the remaining set (e.g. ns1 and ns2) according to the policy
•often clients use sophisticated policies that "score" servers and pick more often the ones that replied faster
•as a by-product, in practice this policy makes caches favor "nearest" servers
That was quoted from:
When is a secondary nameserver hit?
http://serverfault.com/questions/130608/when-is-a-secondary-nameserver-hit
===============
So you have to check when the first DNS goes down, not all directory enabled apps can handle it. opened.
Another issue is the client has bounded to the logon server during the DC Locator process. That's difficult to mess with other than restarting the machine...
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.