>they get a dynamic update refusal code 5.
This happens when the machine account requesting the reverse DDNS update does not have permission to do the update. A common cause is a machine does DHCP, gets an IP address, and then adds it via DDNS. At this point, that machine owns the record (Windows permission wise).
Sometime later a different device gets that same IP address via DHCP. It goes to update the existing reverse record - but it does not own it - the prior device does, and Windows DNS refuses the update.
A bit of a fundamental problem with Windows DDNS huh? It expects that once a device gets an IP address it will never change.
I often solve it by changing the default permission on the reverse DDNS zone to allow unauthenticated updates. This means anything can update a reverse DNS entry. If you do a "nslookup" you have to consider that the returned entry is not guaranteed to be who it says - but reverse DNS is mostly for information purposes anyway.
