So, I have two AWS-based environments that are largely separated, but are connected via an intermediary VPC that hosts a VPN server, and has routing into each of the individual environments. Let's call these "A", "B" and "Management" VPCs.
"A" and "B" each have an Active Directory (a Microsoft Directory in AWS Directory Services), and the VPN is configured to use "A" to resolve DNS. Now, I want to bring "B" into DNS scope, so connecting users don't need to use IP addresses to connect to "B"'s servers.
To that end I set up the routes in my VPCs to allow the DCs to talk to each other, and confirmed at a network level that everything is open. Then, I set up a conditional forwarder in "A" to forward requests to "B" for its suffix.
(Note: I have, obviously, redacted all the actual names. Not for privacy, but to avoid confusion, since they are very similar)
However, when I try and query a "B" from an "A" server, it doesn't work. If I manually specify "B"'s DNS, however, it does work. Am I missing something important here?