RODC Samba DNS Records Not Replicating

[carlitostevez]

Hello, how are you?

We installed a new RODC server with Samba DNS backend (ucsrodc).

dns/backend: samba4

As mentioned in the documentation:
Univention Documentation

When joining the server to the domain, the initial synchronization is performed and the existing records appear in Samba.

However, when we create new DNS records on the master, they are not replicated to the RODC DNS. (They do appear in LDAP, but not in Samba.)

Running the following queries on the RODC (ucsrodc) gives us:

samba-tool dns query ucsrodc.mydomain.com mydomain.com dnstest A -U Administrator
Password for [MYDOMAIN\Administrator]:
ERROR: Record or zone does not exist.

univention-ldapsearch -LLL “(zoneName=mydomain.com)” dn | grep dnstest
dn: relativeDomainName=dnstest,zoneName=mydomain.com,cn=dns,dc=mydomain,dc=com

Is this the expected behavior, or should the record also appear in Samba?

thanks very much,
best regards.

[MiracErde]

Hi @carlitostevez,

maybe this knowledge base articles could help you, to understand if the drs replication works in you environment and solve the issue.

Problem: Unexpected behavior in DNS Zone Transfers

Problem The command: dig axfr @'dns ip address' "domain fqdn" is used to initiate a DNS zone transfer (DNS zone replication) between DNS servers. DNS zone transfers should only be allowed between authorized DNS servers. If this command can successfully execute from any IP address, it constitutes a significant security vulnerability, as it allows unauthorized users to obtain sensitive information about the domain. This information may include: A list of all machines in the domain IP addresses …

Samba 4 Troubleshooting

Samba 4 Troubleshooting Guide DRS Replication Further Articles for Replication issues are samba-tool-drs-showrepl-shows-werr-gen-failure and drs-replication-fails samba-tool drs showrepl To get an overview of the current drs replication status you can use this command at every UCS Samba 4 DC which is joined to the domain: samba-tool drs showrepl Sitename\Servername DSA Options: 0x00000001 DSA object GUID: ffad9f19-0e90-457b-b733-469e4b2280a1 DSA invocationId: 908dbb52-12a6-47a2-ae03-1a71014c…

Best regards,
Mirac

[carlitostevez]

First of all, thank you very much for your response, and apologies for the delay.

We reviewed the links you sent us, but unfortunately without positive results.

I would like to share a new test we performed.

We installed a new server from scratch with the RODC role:

ucr get samba4/role
RODC

ucr get ldap/server/type
slave

On this server, the queries worked correctly:

samba-tool dns query ucsrodc.mydomain.com mydomain.com dnstest A -U Administrator

univention-ldapsearch -LLL "(zoneName=mydomain.com)" dn | grep dnstest

We were also able to create new DNS records successfully, and everything continued working as expected.

However, after 21 days, following the machine password change attempt triggered by this cron job, DNS updates stopped working:

/etc/cron.d/univention-server-slave

0 1 * * * root /usr/sbin/jitter 600 /usr/lib/univention-server/server_password_change

We found the following error in the log file:

/var/log/univention/server_password_change.log

[2026-06-10 01:08:51.821348424] Failed to set new password in samba, machine password set back to old password for cn=ucsrodc,cn=dc,cn=computers,dc=mydomain,dc=com

We are not sure whether this is related to the issue, but we know that from this point onward the querys stopped working.

This brings us back to the same problem we have observed on the other domain controllers: the LDAP query continues to return the expected result,

univention-ldapsearch -LLL "(zoneName=mydomain.com)" dn | grep dnstest

but the Samba query no longer works:

samba-tool dns query ucsrodc.mydomain.com mydomain.com dnstest A -U Administrator

Do you have any suggestions regarding what could cause the machine password change process to fail and whether this could explain the DNS query issue we are seeing afterward?

thanks very much,
best regards.