I have 2 sites connected via Datto Site to Site VPN.

The DC is on site 1.

When I NSlookup from S2 to S1 I get:

Note: This information is intended for a network administrator. If you are not your network’s administrator, notify the administrator that you received this information, which has been recorded in the file C:\WINDOWS\debug\dcdiag.txt.

The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain ““domain”.local”:

The error was: “DNS name does not exist.”
(error code 0x0000232B RCODE_NAME_ERROR)

The query was for the SRV record for _ldap._tcp.dc._msdcs.“domain”.local

Common causes of this error include the following:

The DNS SRV records required to locate a AD DC for the domain are not registered in DNS. These records are registered with a DNS server automatically when a AD DC is added to a domain. They are updated by the AD DC at set intervals. This computer is configured to use DNS servers with the following IP addresses:

192.168.x.x

One or more of the following zones do not include delegation to its child zone:

“domain”.local
local
. (the root zone)

Any ideas would be throughly helpful.

@Datto_Inc

Make sure your DNS Servers are pointing to internal DNS servers.
Check your records in the DNS, check replication
Verify IP address of destination.
Check Gateway settings
IPConfig flush and register

The DNS in the Advanced TCP/IP settings are set to use 127.0.0.1 first and 192.168.x.x on the DC and the PC I am trying to connect is set to the 192.168.x.x.

Unsure what you mean as far as replication goes.

I have verified the IP of the DC several times.

Gateway settings are also correct afaik.

Systems has been flushed and restarted a few time as well.

When you perform an nslookup it outputs that error and writes to dcdiag log? or did you actually run dcdiag?

Is the client at site 2 (PC/server etc) using the DC at Site 1 as it’s dns server?

Can the PC ping:
it’s default gateway?
the DC IP address? if not can it ping the default gateway of the DC?

How is the VPN configured - for example it is a Datto appliance at each site?
Is the Datto appliance the default gateway for the lan devices? If not has the default gateway/router/firewall had a route added for the remote site?

If the above does not make sense, then Traceroute from S1 to S2, and from S2 to S1 providing the output and explaining what each ip address is

Yes, it can ping all 3.

The VPN is configured by the Datto devices, and there is 1 Datto at each site directly behind the modem and before the rest of the network. I am starting to think the issue lies with the security gateways on each network. The ports show as open, but still not able to connect through. PC’s on the main network (where the DC is) connect just fine.

Issue was resolved with a setting in Datto.

On the Datto Networking Appliance page. Go to:

Applications

Conditional DNS Forwarding

DNS Static Host Records

Set Domain info

Remote system was then able to resolve Domain over StS VPN.