Implement and manage an on-premises and hybrid networking infrastructure
DNS decisions that get tested
Know when to choose a conditional forwarder versus a stub zone. A conditional forwarder caches answers and points at fixed addresses, so if the target name servers change you must edit it. A stub zone holds only the NS, SOA, and glue records and refreshes them automatically, so it tracks the remote zone name servers but still requires recursion to resolve other names. Forwarders take precedence over root hints; root hints are used when no forwarder answers and recursion is enabled. AD-integrated zones replicate by scope: forest-wide application partition, domain-wide, or legacy domain. Scavenging depends on the no-refresh and refresh intervals. DNS policies enable split-brain and query filtering.
DHCP
DHCP failover offers load balance mode and hot standby mode, replicates scopes between two servers, and uses a maximum client lead time (one hour by default). Filters allow or deny by MAC address, policies assign options based on device characteristics, and DHCP Guard on Hyper-V blocks rogue servers. On routed networks, an IP helper or DHCP relay forwards requests.
Hybrid and remote access
Always On VPN uses separate device and user tunnels; the device tunnel is IKEv2 only, uses a computer certificate, and needs no user logon. NPS provides RADIUS authentication. Azure-side, a VPN Gateway provides site-to-site and point-to-site, and Azure DNS Private Resolver uses inbound and outbound endpoints with forwarding rulesets to resolve between on-premises and Azure private zones.
Traps
Stub zones still need recursion; conditional forwarders do not follow name server changes. DHCP failover partners communicate on TCP 647. Point-to-site protocols differ, and only IKEv2 supports the device tunnel.
Rule of thumb
Target name servers are stable, use a conditional forwarder; they change, use a stub zone.