Maeve

Many administrators are removing DNS delegation when demoting domain controllers. However, this may not be the best practice.

When a domain controller is demoted, it no longer has the authority to resolve DNS names. If the domain controller is the sole source of DNS resolution for a particular namespace, then its delegation may need to be removed in order to avoid service disruptions.

However, if the domain controller’s delegation is only for a subset of the namespace, then it may be better to leave the delegation in place.

A better practice would be to have a secondary domain controller that is responsible for resolving DNS names for the namespace. This secondary domain controller can be promoted to the role of domain controller when the primary domain controller is demoted.