David Hartburn wrote:
For our LDAP queries, we have specified the forest DNS name as the LDAP server, so that we achieve via DNS a random distribution of queries against our AD servers. Previously we had hammered the first server on the list.
You're doing DNS round-robin now? Note that this does not necessarily means good load-balancing.
This has kept our AD guys happy, but we have noticed that at busy times our FR servers are doing over 100 DNS queries per second, for the same thing.
What is "for the same thing"? What are the DNS TTLs for the queried records? You also did not say anything about the authc mechs used. If Kerberos or similar is used there could be more DNS lookups. As others said I'd also recommend to use a local caching DNS resolver in case you cannot improve anything else. Ciao, Michael.