Reproduce by doing the following: * Provision a root DC and start it * Join two DCs with "samba-tool domain join" using the --targetdir option * Run "host" command with the domain name passed to the provision command * Demote one of them with on samba-tool domain demote --remove-other-dead-server * Run "host" command again with the same domain name First host command will return the name resolution as expected. Second host command will return nothing but will exit with code 0. If you use 'dig' you'll see there is a response with an authority section but no answer. Looking at ldap it seems the demote process causes root records to be tombstoned (deleted, basically). This happens because the remove_dns_references function assumes that each DC will have its own IP, so it removes all records with references to the IP of the DC being demoted. For now I'm working around this problem by adding an option for the "join --targetdir" workflow allowing the user to override the IP of the new DC. This shouldn't come up in the field since no one creates a second DC on the same machine as the root (or if they do they use VMs).