w2k DNS changes itsself

[BigShyBear]

Over the weekend we replaced our SQL server - changed out the box with a new box running Win 2003 server standard. Since we were here over the weekend, we decided to move a couple of servers to a new 19" rack. One of the ones we wanted to move was our intranet server/DNS server/win2k DC/AD bridgehead server. After we shut it down and brought it back up I noticed that AD was not replicating. Chased the problem down to the DNS on the intranet server. The Win2k domain name is our companies internet address, xxxxxx.com After experimentation - I discovered:
Create the forward lookup zone, works fine. Stop the DNS service, start it again, and the forward lookup zone gives me a red X and stops, and changes the SOA record to point to the outside DNS server - our ISP's DNS server which hosts our outside DNS. Stop and start DNS service again and the forward lookup zone disappears completely. The zone file remains in \winnt\system32\dns so I can create the zone again.
What I ended up doing was putting DNS on a different box, but this box is not one I completely trust - it's older hardware.
Anybody have any clues for me?
Thanks
Mike Gallo

 

[somebigguy]

The intranet server should only be hosting the internal Active Directory integrated zone. It shouldn't even need to be created, it should appear automatically.

Set the primary DNS on the Intranet server to another DNS server inside hosting the Active Directory domain, set the secondary DNS server to itself. Make sure that it hosts only the internal AD integrated scope and has no knowledge of the external DNS server.

I've been in situations like this when both the internal and external zones are the same and you are forever chasing down DNS problems.

 

[BigShyBear]

Figured it out - problem was a bizarre one. The Win2K DNS service was initially created by my predecessor. He had modified the root hints, put in the IP address of our Symantec Raptor (axent) firewall as the only root hint. I changed out the firewall to a hardware firewall about 2 months ago (Symantec SGS). This weekend was the first time I had stopped and started the DNS service after replacing the firewall 2 months ago. Now I have the root hints correct, and everything works correctly.
Bigshybear