DNS and Directory Services
Source: Prior BarnesBears Samba AD, AdGuard, DHCP and resolver troubleshooting sessions. Recheck on live systems before changes.
Active Directory
| Property | Value |
|---|---|
| AD DNS domain | barnesbears.xyz |
| Primary domain controller | ad-1 — 192.168.10.28 |
| Additional domain controller | ad-2 — 192.168.10.29 |
| Implementation | Samba Active Directory |
Known ad-2 OS |
Debian 13 (Trixie) |
| Domain DNS | AD-integrated DNS with LDAP/Kerberos SRV records |
The two controllers were previously verified to replicate successfully, with correct _ldap._tcp.dc._msdcs SRV records.
Resolver design
The intended server/client configuration is to use both AD DNS servers (.28 and .29) for domain-aware DNS resolution. AdGuard at 192.168.10.82 is also present for filtering.
A previous resolver issue involved a conditional forwarding loop through AdGuard. The loop was removed. Avoid adding circular DNS forwarding paths.
UniFi DHCP has been used to distribute DNS settings. It also participates in reverse lookup handling for devices without explicit DNS records. Verify the current DHCP option values and resolver forwarding chains rather than assuming the historical configuration is still current.
Quick checks
getent hosts ad-1.barnesbears.xyz ad-2.barnesbears.xyz
dig @192.168.10.28 _ldap._tcp.dc._msdcs.barnesbears.xyz SRV
dig @192.168.10.29 _ldap._tcp.dc._msdcs.barnesbears.xyz SRV
dig @192.168.10.28 traefik-1.barnesbears.xyz
resolvectl status
On the domain controllers, check replication and service health using the Samba administration commands appropriate to the installed version.
Time synchronization
The planned time source hierarchy uses ad-1 as the preferred Chrony source, with ad-2 as backup for managed hosts. The Ansible Chrony role is intended to enforce this across the fleet. Verify live synchronization status with chronyc sources -v and chronyc tracking.
Authentication integrations
Samba AD supports joined Linux systems through realmd/SSSD and LDAP-backed applications. Keycloak provides application SSO for selected reverse-proxied services; see Traefik.
Operational cautions
- Never remove the last working DNS resolver or DC during maintenance.
- Verify forward and reverse lookups, SRV records, and AD replication after changes.
- Do not use AdGuard as an AD DNS replacement without preserving AD-specific resolution.
- Record changes to DHCP options, forwarding, and DNS aliases in this documentation.