1. Chapter 9: Configuring DNS for Active Directory
MCTS Guide to Configuring Microsoft Windows Server 2008 Active Directory
Chapter 9: Configuring DNS for Active Directory

2. Objectives Describe the structure of Domain Name System
Install and use the DNS Server role in Windows Server 2008
Configure DNS zones
Configure advanced DNS server settings
Monitor and troubleshoot DNS
MCTS Windows Server 2008 Active Directory 2

3. Introduction to Domain Name System
Domain Name System (DNS) is a distributed hierarchical database composed mainly of computer name and IP address pairs
In order to resolve a name to an address, a DNS lookup will often require multiple queries to a hierarchy of DNS servers
MCTS Windows Server 2008 Active Directory

4. The Structure of DNS
DNS can be described as an inverted tree structure
Entire DNS tree is called the DNS namespace
Each domain has one or more servers that are authoritative for the domain
Root servers keep a database of addresses of other DNS servers managing top-level domain names, called top-level domain (TLD) servers
MCTS Windows Server 2008 Active Directory

5. The Structure of DNS (cont.)
MCTS Windows Server 2008 Active Directory

6. The DNS Database
A zone is a grouping of DNS information that represents one or more domains and possibly subdomains
Zones contain a variety of record types called resource records, which contain information about network resources
DNS records can be added and changed by:
Static updates
Dynamic updates
MCTS Windows Server 2008 Active Directory

7. The DNS Database (cont.)
DNS resource record types
MCTS Windows Server 2008 Active Directory

8. The DNS Lookup Process
Two different types of DNS lookup can be performed
Iterative query
A DNS server will respond with the best information it has to satisfy the query, or it may give a referral response
Recursive query
DNS server processes the query until it responds with an address that satisfies the query or with an “I don’t know message”
A typical DNS lookup made by a DNS client can involve both recursive and iterative queries
DNS clients maintain a Hosts file that can contain static DNS entries; Hosts is stored in %systemroot%\System32\drivers\etc
MCTS Windows Server 2008 Active Directory

9. The DNS Lookup Process (cont.)
MCTS Windows Server 2008 Active Directory

10. DNS Server Roles
DNS servers can perform one or more of the following roles for a zone:
Authoritative server
Holds a complete copy of a zone’s resource records
Forwarder
A DNS server to which other DNS servers send requests they can’t resolve themselves
Conditional forwarder
DNS server to which other DNS servers send requests targeted for a specific domain
Caching-only server
Does not have zones; it fields DNS queries, does recursive lookups to root servers, or sends requests to forwarders and then caches the results
MCTS Windows Server 2008 Active Directory

11. DNS Zones Three different types of zones Primary zone Secondary zone
Contains a read/write master copy of all resource records for the zone; it is considered authoritative for the zone
Secondary zone
Contains a read-only copy of all resource records for the zone; it is considered authoritative for the zone
Stub zone
Contains a read-only copy of only the SOA and NS records for a zone and the necessary A records to resolve NS records; not authoritative
MCTS Windows Server 2008 Active Directory

12. Installing DNS
DNS installation begins by installing the DNS Server role in Server Manager
If the DNS server is intended to manage domain name services for Active Directory, DNS Server role should be installed on a domain controller
Windows automatically detects whether or not the server is configured as a domain controller and then integrates DNS zones with Active Directory
MCTS Windows Server 2008 Active Directory

13. Creating DNS Zones
An Active Directory integrated zone is a primary or stub zone with the DNS database stored in an Active Directory partition
Installing DNS on a domain controller that is part of an existing domain will have zone information copied to it automatically during AD replication
Some situations may require that a zone be created manually
Zones that are not Active Directory integrated are referred to as standard zones
MCTS Windows Server 2008 Active Directory

14. Creating DNS Zones (cont.)
MCTS Windows Server 2008 Active Directory

15. Active Directory-Integrated Zones
“Store the zone in Active Directory” check box means you want the zone stored in an Active Directory partition
Standard zones are stored in a text file called zone-name.dns, which is located in the %systemroot%\system32\dns folder
Active Directory-integrated zones have the following advantages over a standard zone:
Automatic zone replication
Multimaster replication and update
Secure updates
Efficient replication
MCTS Windows Server 2008 Active Directory

16. Zone Replication Scope
After selecting the zone type and specifying the zone to be stored in Active directory, you are asked to select the zone replication scope with one of these options:
To all DNS servers in this forest
To all DNS servers in this domain
To all domain controllers in this domain (for Windows 2000 compatibility)
To all domain controllers specified in the scope of this directory partition
MCTS Windows Server 2008 Active Directory

17. Forward and Reverse Lookup Zones
Next, you are asked whether a zone should be a forward lookup zone or a reverse lookup zone
FLZ – Forward lookup zone contains records that translate names to IP addresses, such as A, AAAA, and MX records
RLZ – Reverse lookup zones contain PTR records that map IP addresses to names and is named after the IP network address (IPv4 or IPv6) of the computers whose records it contains
MCTS Windows Server 2008 Active Directory

18. Dynamic Updates
Final step allows you to choose whether and how to use dynamic updates, which can be configured in one of three ways
Allow only secure dynamic updates
Allow both nonsecure and secure dynamic updates
Do not allow dynamic updates
Dynamic updates enable DNS client computers to register and dynamically update their resource records with a DNS server whenever changes occur
MCTS Windows Server 2008 Active Directory

19. Creating Zones from the Command Line
Dnscmd.exe can create and configure various DNS settings
Basic syntax: dnscmd server /command
Examples:
Create a new primary Active Directory-integrated zone named zone1 that allows only secure dynamic updates: dnscmd server99 /ZoneAdd zone1 /DsPrimary
Add an A record for the host named host1 in zone1 with the IP address : dnscmd server99 /RecordAdd zone1 host1 A
MCTS Windows Server 2008 Active Directory

20. Configuring DNS Zones Zones can be viewed and changed in DNS Manager
DNS Manager provides the following options:
Status
Type
Replication
Dynamic updates
Aging
MCTS Windows Server 2008 Active Directory

21. Configuring DNS Zones (cont.)
MCTS Windows Server 2008 Active Directory

22. Aging and Scavenging Resource Records
Stale resource records can degrade server performance, provide incorrect information, and generally make DNS less reliable and efficient
Enabling scavenging causes the server to check for stale records periodically and deletes those meeting the criteria for a stale record
Options in the Zone Aging/Scavenging Properties dialog box
Scavenge stale resource records
No-refresh interval
Refresh interval
The zone can be scavenged after
MCTS Windows Server 2008 Active Directory

23. Start of Authority Records
SOA records are found in every zone and contain information that identifies the server primarily responsible for the zone as well as some operation properties for the zone
The SOA record contains the following information:
Serial number
Primary server
Responsible person
Refresh interval
Retry interval
Expires after
Minimum (default) TTL
MCTS Windows Server 2008 Active Directory

24. Name Server Records
NS records specify FQDNs and IP addresses of authoritative servers for a zone
NS records are also used to refer DNS queries to a name server that has been delegated authority for a subdomain
Glue A records are A records containing a name server’s IP address and are used to resolve NS record information
MCTS Windows Server 2008 Active Directory

25. Zone Delegation
Zone delegation is transferring authority for a subdomain to a new zone, which can be on the same server or another server
The server hosting the parent zone maintains only an NS record pointing to the DNS server hosting the delegated zone
_msdcs subdomain exists inside every Windows domain zone and holds SRV records for Microsoft-hosted services, such as global catalog, LDAP, and Kerberos
MCTS Windows Server 2008 Active Directory

26. Zone Delegation (cont.)
MCTS Windows Server 2008 Active Directory

27. Using Stub Zones
Stub zones are a special type of zone that contain only an SOA record, one or more NS records, and the necessary glue A records to resolve NS records
Reasons for using stub zones
Maintenance of zone delegation information
In lieu of conditional forwarders
Faster recursive queries
Distribution of zone information
MCTS Windows Server 2008 Active Directory

28. Zone Transfers
A zone transfer copies all or part of a zone from one DNS server to another and occurs as a result of a second server requesting the transfer from another server
Zone transfers can be initiated in two ways
Refresh interval
DNS notify
Zone transfers are configured in the Zone Transfers tab of a zone’s Properties dialog box, which has the following options:
Allow zone transfers
To any server
Only to servers listed on the Name Servers tab
Only to the following servers
Notify
MCTS Windows Server 2008 Active Directory

29. Incremental Zone Transfers
Two types of zone transfer
Full zone transfers
Incremental zone transfers
Both master and slave DNS servers must support incremental zone transfers to use them
During the initiation of an incremental zone transfer, the serial number decides whether the slave or the master determines the differences between its current zone data and the zone data on the other server
MCTS Windows Server 2008 Active Directory

30. Using WINS with DNS
Windows Internet Name Service (WINS) is a legacy name service used to resolve NetBIOS names, sometimes referred to as single-label names
Similar to DNS in that it keeps a database of name-to-address mappings
Generally used in environments that require NetBIOS resolution or where applications depend on it
The WINS tab has the following options:
Use WINS forward lookup
Do not replicate this record
IP address
Time to live (TTL)
MCTS Windows Server 2008 Active Directory

31. Using the GlobalNames Zone
GlobalNames zone (GNZ) allows administrators to add single-label names to DNS, giving client computers the ability to resolve these names without including a DNS suffix in the query
Entries must be made manually
Can assist mobile users by dropping the need for remembering a resource’s FQDN
Enabled via dnscmd.exe
Dnscmd server /config /EnableGlobalNamesSupport 1
MCTS Windows Server 2008 Active Directory

32. DNS Forwarders
Referring a DNS query to a forwarder can be more efficient under some situations
When the DNS server address for the target domain is known
When only one DNS server in a network should make external queries
When a forest trust is created
When the target domain is external to the network and an external DNS server’s address is known
Conditional forwarding allows queries for particular domains to particular name servers and all other unresolved queries to a different server
MCTS Windows Server 2008 Active Directory

33. Configuring Traditional Forwarders
To configure a traditional forwarder, right-click the server node in DNS Manager, click Properties, and click the Forwarders tab
If more than one server is specified, they are queried in the order in which they’re listed
Additional servers are only queried if the first server provides no response
No response from any forwarders triggers a normal recursive lookup process, starting with a root server
MCTS Windows Server 2008 Active Directory

34. Configuring Conditional Forwarders
Previously, traditional and conditional forwarders were configured under the Forwarders tab, but Server 2008 has conditional forwarders as a node in DNS Manager
With forwarders and/or conditional forwarders configured, the DNS server attempts to resolve DNS queries in this order:
1. From locally stored zone resource records
2. From the DNS cache
3. From conditional forwarders
4. From traditional forwarders
5. Recursively by using root hints
MCTS Windows Server 2008 Active Directory

35. Root Hints
Root hints consist of a list of name servers preconfigured on Windows DNS servers that point to Internet root servers
These servers contain lists of name servers that are responsible for top-level domains
Root hints data comes from the Cache.dns file located in the %SystemRoot%\System32\DNS folder
Internal DNS servers can be configured as root servers if the network is isolated from the public Internet
MCTS Windows Server 2008 Active Directory

36. Round Robin
Load sharing can be configured among servers running mirrored services
Accomplished by creating multiple A records with the server’s name in both records but with each entry configured with a different IP address
DNS will then respond to queries by sending all addresses associated with the server’s name but will also vary their order
This process is called round robin because each IP address is placed first in the list an equal number of times
MCTS Windows Server 2008 Active Directory

37. Recursive Queries
Recursion is enabled on Windows DNS servers by default, but there are two ways to change this setting
First involves configuring forwarders
Second is the “Disable recursion (also disables forwarders)” option in the Advanced tab of the DNS server’s Properties dialog box
Recursion might be disabled when you have a public DNS server containing resource records for your publicly available servers, but you don’t want unauthorized users using your DNS server for recursive client requests
MCTS Windows Server 2008 Active Directory

38. Event and Debug Logging
When DNS is installed, a new event log is created to record informational, error, and warning events generated by the DNS server
Common events include zone serial number changes, zone transfer requests, and DNS server startup and shutdown events
Debug logging can be enabled in the server’s Properties dialog box
Debug logging records selected packets coming from and going to the DNS server in a text file
MCTS Windows Server 2008 Active Directory

39. Event and Debug Logging (cont.)
MCTS Windows Server 2008 Active Directory

40. DNS Troubleshooting
Windows has several tools to administer, monitor, and troubleshoot DNS server operation, including the following tools:
DNS Manager
Dnscmd.exe
Event Viewer
Dnslint
Nslookup
Ipconfig
Performance Monitor
Protocol analyzer
MCTS Windows Server 2008 Active Directory

41. Monitoring DNS Performance
DNS performance can degrade over time because of increased database size and increased client activity
Dnscmd.exe can display a snapshot of server statistics with the dnscmd.exe /statistics command
Performance monitor can continuously monitor and gather statistics
Creating a performance baseline is good practice for troubleshooting issues that may arise later on
MCTS Windows Server 2008 Active Directory

42. Monitoring DNS Performance (cont.)
MCTS Windows Server 2008 Active Directory

43. Chapter Summary
DNS is based on a hierarchical naming structure and a distributed database
DNS can be described as an inverted tree with the root domain at the top, TLDs branching off the root, and domains and subdomains branching off TLDs
The DNS database is composed of zones containing resource records, such as Start of Authority (SOA), Host (A), and Service (SRV) records
MCTS Windows Server 2008 Active Directory

44. Chapter Summary (cont.)
DNS lookups involve iterative and recursive queries
Most lookups start from the DNS resolver with a recursive query to a DNS server; the DNS server satisfies the query or performs a series of iterative queries, starting with a root server
DNS servers can perform one or more of the following roles: authoritative server, forwarder, conditional forwarder, and caching-only server
Active Directory-integrated zones have the advantages of automatic replication, multimaster replication, and update, secure updates, and efficient replication
MCTS Windows Server 2008 Active Directory

45. Chapter Summary (cont.)
A zone can be a forward lookup zone or a reverse lookup zone
SOA records contain information about a zone, including its serial number and a number of timers used for zone transfers
Subdomains can be delegated to a zone on another server to improve performance and control replication scope
Advanced DNS settings include configuring forwarders, root hints, round robin, recursive queries, and logging
MCTS Windows Server 2008 Active Directory

46. Chapter Summary (cont.)
Tools for monitoring and troubleshooting DNS include Dnscmd, Dnslint, Nslookup, Ipconfig, and Performance Monitor
You need to understand the DNS query process to troubleshoot DNS problems efficiently
MCTS Windows Server 2008 Active Directory