[Samba] Changing DC from external to internal DNS

[Lars Hanke]

I set up two AD DC with external bind and it used to work for a while. 
Following a Bind9 upgrade named complained about missing SOA and NS 
records in the DLZ zones and could not be started anymore.

Monday, due to a misinterpretation of some queries, I restarted Bind on 
the hitherto working system and I got the same error messages. No 
nothing changed - no changes in configuration, no updates.

I made a slave DNS master and activated its backup of the AD zone, so 
the infrastructure is currently working.

Since I asked about that issue before on this list and received no 
answer, I assume it is unknown. Whatever I tried to analyze the ldb, I I 
couldn't find anything suspicious.

However, my idea now is to reduce complexity. Use the internal DNS for 
the AD zone and keep the slave Bind to serve requests from the network.

My questions:

1) Can the internal DNS of Samba4 work as a master DNS, or are features 
missing, e.g. zone transfer, which are expected by the slave?

2) As it seems the steps for falling back to internal DNS are: demote 
one AD DC, configure a new one with internal DNS, join it as new DC. 
Then do the same with the other DC. Is there a simpler method or 
anything more to consider? Did someone do that before?

Thanks for your help,
  - lars.