BIND: Slave zone to Master zone(Windows 2012 DC) doesn't work

  • I've searched and then tried inquiring with a few posts with no luck. So I'm reattempting again with a more detailed post about my setup.

    WAN aka em0
    Interface IP:

    LAN aka em1
    Interface IP:
    DHCP: range
    Got a static NAT of =>

    OPT1 aka em2
    Transparent bridge
    Interface IP:
    DHCP: range of
    DHCP being served to a couple of Windows 7 VMs
    Windows 2012 DC; also setup as DNS server; has static IP of

    BIND master zone config file:
    $TTL 1h

    ; Database file for zone.
    ; Do not edit this file!!!
    ; Zone version 2437079441
    ; IN  SOA (
    2437079441 ; serial
    1d ; refresh
    2h ; retry
    4w ; expire
    1h ; default_ttl

    ; Zone Records
    @ IN NS
    @ IN A

    ;custom zone records
    @        IN NS
    localhost IN A

    Master zone works as clients on LAN and OPT1 interfaces resolve the defined zone records.


    1. Setup Windows 2012 as subdomain and called the new forest; FQDN is

    2. Setup same Windows 2012 DC as DNS server

    3. In pfsense>BIND, setup ACL, Views, slave zone for littlesheep

    3a) ACL includes 7 with hostname baaah) 7 with hostname lambchop) 2012 DC with DNS)

    3b) View Name is "littlesheep
    Recursive "YES"
    Match-Client "littlesheep"
    Allow-recursion "littlesheep"

    3c) Zone Name is
    Zone Type "slave"
    View "littlesheep"
    Master Zone IP ""
    Allow-Query "littlesheep"
    Allow-transfer "littlesheep"
    Zone Domain Records:
      www cname A A A


    1. On shepherd(DC), I set it to all transfer for ANY.  I go to one of my Windows 7 box and try to join it to, I get this message:

    The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain "":

    The error was: "DNS name does not exist."
    (error code 0x0000232B RCODE_NAME_ERROR)

    The query was for the SRV record for

    Common causes of this error include the following:

    • The DNS SRV records required to locate a AD DC for the domain are not registered in DNS. These records are registered with a DNS server automatically when a AD DC is added to a domain. They are updated by the AD DC at set intervals. This computer is configured to use DNS servers with the following IP addresses:

    • One or more of the following zones do not include delegation to its child zone:
    . (the root zone)

    I thought by setting up the slave zone with the littlesheep view, the Windows 7 VMs should be able to join the domain but it doesn't.  When I'm at the Windows 7 VM, I can ping and it resolves.  If I'm on the Windows 7 VMs, and I manually add the DC IP in the DNS field in network properties, I can join the domain.  But on the Windows 7 VM, DHCP DNS address is of the pfsense(, it won't join.

    Any ideas what's happening here?

Log in to reply