With two enterprise DNS servers, must forwarders, cache and root hints be identical?

AD-integrated zones can replicate, but conditional forwarders, server forwarders, root hints, cache and firewall paths still require separate verification.

1. Conclusion and scope

Configuring two DNS addresses on clients does not guarantee that the second server has the same capabilities. AD-integrated zone data usually replicates, but server-level forwarders, debug logging, recursion policy, firewall egress and cache state can differ and often become visible only during failure.

This issue involves Active Directory, DNS, Group Policy, authentication and domain-controller health. Validate replication, backup and scope before change.

2. Risk signals that deserve priority

• Some clients work and others fail depending on which DNS server they currently use.
• When the primary DNS is stopped, domain sign-in or vendor-name resolution fails immediately.

3. Pre-change assessment checklist

1. Compare zone type, replication scope, serial, dynamic update and ageing/scavenging.
2. Compare global forwarders, conditional forwarders, root hints, recursion and timeout.
3. Verify firewall paths from each DNS server to upstream resolvers, domain controllers and client networks.
4. Check DHCP options, static clients and VPN profiles all provide the two correct addresses.

Get-DnsServerZone
Get-DnsServerForwarder
Get-DnsServerConditionalForwarderZone
Get-DnsServerRootHint

4. Recommended implementation sequence

1. When storing conditional forwarders in AD, select the correct replication scope.
2. Create a scripted baseline and scheduled comparison for server-level settings that do not replicate.
3. Clear cache, restart the service and run independent resolution tests on each server.
4. Monitor query failures, recursion timeout, service state and log-volume capacity.

5. Validation, rollback and common mistakes

• Clients can use either DNS server for internal and approved external resolution.
• Work continues during primary-DNS maintenance without client reconfiguration.
• Any intentional configuration difference is documented and approved.

Common mistakes

• Adding a conditional forwarder only to the primary server.
• Assuming caches must synchronise; caches are local, while configuration and resolution outcomes should align.
• Publishing DNS address order that does not match actual availability.

Frequently asked questions

Do the two DNS caches synchronise automatically?

No. Each server maintains its own cache; the upstream path and configuration should still produce consistent answers.

Must root hints be identical?

They should match the intended resolution baseline. If forwarders are mandatory, also decide whether root-hint fallback is allowed.