Understanding Skype for Business DNS Records and Autoconfiguration

Skype for Business DNS Records are one of critical components of the whole infrastructure. Skype for Business uses two types of DNS records: A record and SRV record.

The DNS is often deployed as “split-brain” DNS deployment: the same zone name is deployed internally and externally but with different (internal or external) IP-addresses for the same entries.

Thus Skype for Business clients will get information only from their zone, so if  external client is trying to connect to Skype for Business server, it will resolve the entries to the external IP-addresses, if it’s from internal network then it will resolve the DNS entries to internal IP-addresses using the internal DNS server.

If you are not using “split-brain” DNS you can create a zone for each required DNS records pointing it to the internal IP-address.

Skype for Business DNS Records requirements

Skype for Business Internal DNS Records

Skype for Business External DNS Records

It’s not easy to find Skype for Business DNS Requirements for multiple Edge pools. Copypasted articles for the simplest scenario are everywhere… Finally I managed to figure out the stuff. In the example below there are two Edge pools with two Edge servers in each. Each pool has it’s own Reverse Proxy:

As you can see in case of multiple pools with multiple servers we need DNS A Record for each server in each pool. The last three records are common for the whole Skype for Business infrastructure.

Skype for Business Desktop Client Sign-In Process

Since Lync 2013 clients favor Autodiscover services over DNS SRV records to locate the Front End server.

Autodiscover process

Both desktop and  mobile clients will attempt to resolve DNS records in the following order:

1. lyncdiscoverinternal.(sip-domain) , this is an internal record so the client needs to be in internal network to be able to resolve this record, if the client couldn’t resolve the record it knows it is outside the corporate network and goes to step two
2. lyncdiscover.(sip-domain)
If Mobile client failed to resolve this record it will fail to login and stop trying!

Desktop client will try to failback to DNS SRV Records:

DNS SRV discovery process (desktop client only!)

1. _sipinternaltls.tcp_(sip-domain) using TLS
2. _sipinternal.tcp.(sip-domain) using TCP
3. _sip._tls.(sip-domain) using TLS (Externally only)
4. sipinternal.(sip-domain) , internal A record of the Frontend / Director pool
5. sip.(sip-domain) , Internal A record of the Frontend / Director pool (Internally) , or Access Edge Service (Externally)
6. sipexternal.(sip-domain) , A record for the external Access Edge services (Externally only)

The DNS record that got resolved by client will tell the client the FQDN and port of the SIP register server (either Front End or Director server). If you using DNS load balancing, then the client will get all the IP-address of the servers in the pool in a random way.

The client will try to connect starting from the first IP and after successful connection it will most probably be redirected to it’s main registrar front end server.

You can check which pool user belongs to and which FrontEnd is primary registrar for them by using the following commandlet:

If you using Hardware load balancing, the Skype for Business Client will get the VIP of the hardware load balancer.