Active Directory DNS and DC Locator Troubleshooting: Checking SRV Records

In Active Directory, clients find a Domain Controller through the DC Locator process, which depends on the Active Directory SRV records in DNS. A wrong DNS configuration often shows up somewhere else first: as Group Policy, logon, secure channel, Kerberos or replication problems.

Problem and symptoms

• The client cannot find a Domain Controller.
• Domain logon or Group Policy processing is slow or fails.
• nltest /dsgetdc fails.
• The SRV records Active Directory relies on do not resolve.

1. Check the DNS configuration

ipconfig /all

Confirm that the domain member uses the internal DNS servers that can resolve the AD DNS namespace. A public DNS server, or a router listed as a secondary DNS server, is a common cause.

2. Test DC Locator

nltest /dsgetdc:contoso.com

contoso.com is only an example; use your own AD DNS name. Check the DC, site and flags in the output. To ignore the cached DC and run discovery again, use nltest /dsgetdc:contoso.com /force. This does not fix DNS records by itself.

3. Query the Active Directory SRV records

nslookup -type=SRV _ldap._tcp.dc._msdcs.contoso.com
nslookup -type=SRV _kerberos._tcp.contoso.com

Confirm that the expected Domain Controllers are returned, check the target host names in the SRV answers, and verify the A/AAAA records of those names. In multi-site environments, check the site-specific SRV records as well.

4. Check DNS and DC health with DCDiag

dcdiag /test:dns /v

Run this on a Domain Controller. It tests the DNS configuration, delegation, dynamic update and record registration of the DC.

5. DNS registration and Netlogon

If locator records are missing, check the DNS zone, dynamic updates and the Netlogon service. nltest /dsregdns triggers re-registration of the DC Locator DNS records on a Domain Controller; ipconfig /registerdns on a client does not do the same thing. Run each command on the right system and with the right permissions.

ipconfig /registerdns
nltest /dsregdns
Get-Service Netlogon

6. Client DNS cache

ipconfig /displaydns
ipconfig /flushdns

Clearing the cache does not fix a wrong DNS server configuration. Use it only to rule out stale cache entries.

My troubleshooting flow

1. Verify the DNS servers with ipconfig /all.
2. Test DC discovery with nltest /dsgetdc.
3. Query the LDAP and Kerberos SRV records.
4. Run dcdiag /test:dns.
5. Check Netlogon and DNS registration.
6. After the fix, test DC Locator and Group Policy or logon again.

Validate after the fix

Check the DNS servers configured on the client again. Confirm with nltest /dsgetdc:contoso.com /force and the SRV queries that the expected DC is found, then test domain logon or Group Policy processing.

Conclusion

AD DNS troubleshooting is more than querying an A record. The SRV records DC Locator needs, the client’s DNS servers and the DC registration state have to be verified together.

Related guides

A DNS problem in Active Directory usually affects these components as well:

• Group Policy Not Applying? A Step-by-Step GPO Troubleshooting Guide
• Active Directory Replication Errors: Troubleshooting with Repadmin and DCDiag
• The trust relationship between this workstation and the primary domain failed
• Kerberos Authentication Troubleshooting in Active Directory: klist, SPN and KDC