DNS Forwards or Zones? Or how do I setup a backup + forward.

nafeasonto

So this is what I want to do:

I have two domain controllers. Both running DNS for Dynamic Updates, they also run DHCP, so I turned off DHCP on the firewall.

How would I set it up where

DC1 get DHCP request, registers DNS dynamically, but also uses the Firewall as a a DNS backup, so if the Domain Controllers go down, Pfsense still has those names.
How if a DNS request is coming in to the domain controller, it also forwards a DNS registration TO the firewall? Similar to a dynamic update on Windows DNS. (Since DHCP is NOT running on the firewall).

jimp

For that you would need a full DNS server on the firewall like BIND, not Unbound/dnsmasq. The DNS server would need to get updated from AD like a zone transfer, for example, not individually relayed registrations. Like any other secondary/tertiary DNS setup.

johnpoz

So in this scenario both your DCs are down? Because AD can for sure share their dns info.

If both your DCs are down - you have bigger problems then a copy of your dns records running on pfsense ;)

But sure running bind on pfsense would allow for zone xfers from your AD dns..