IPv6 DNS record being published on local AD DNS

I recently was working on a domain controller migration from a SBS 2008 to a 2008 R2 machine. I promoted the new domain controller successfully. Before switching the clients to use the IP of the new DC as their DNS servers, I did my usual checks of the DNS records and made sure that the new DC was returning DNS records properly.

I started by running nslookup and setting the server to my new DC. From there, I did a DNS lookup for the local domain name. Normally, this should return the IPs of the DCs. When I did this, the result returned the local IPs of the DCs, but also returned an IPv6 address starting with 2002:. This isn’t good, since any clients trying to update their group policy may resolve the local domain to that IPv6 address, which could cause some problems down the road.

I checked the IPv6 settings for each NIC on both DCs, but none of the NICs had public IPv6 addresses assigned, just link local addresses (starting with fe80:). I did an ipconfig /all on one server, and I found that that IPv6 address was coming from a Microsoft 6to4 tunneling adapter. The IPv6 address that was returned by nslookup was the same as the 6to4 adapter. Now, why was this 6to4 adapter enabled in the first place?

I found this article: https://blogs.technet.microsoft.com/askpfeplat/2013/11/17/ipv6-for-the-windows-administrator-the-2002-6to4-tunnel-address-and-its-impact/

The article states that whenever a machine has a public IPv4 address assigned to its NIC, it will generate a 6to4 tunneling address. Sure enough, the machine that I was working on here had a 2nd NIC which was not connected to the network, and that NIC had a static public IP assigned to its interface. The IP was from this client’s previous internet service and was no longer needed. I changed the IPv4 configuration from static to DHCP. After that, I ran an ipconfig /registerdns from an elevated command prompt, which got rid of that IPv6 address from AD’s DNS. Woo!

Unknown's avatar

Author: J

I'm an IT consultant in the SF Bay Area.

3 thoughts on “IPv6 DNS record being published on local AD DNS”

  1. Having read this I thought it was really enlightening.
    I appreciate you finding the time and effort to put this short article together.
    I once again find myself personally spending way too much time both reading and posting comments.
    But so what, it was still worth it!

    Like

Leave a reply to Antone Luc Cancel reply