DNS in Windows Server 2003

Module 2: DNS in Microsoft Windows Server 2003 Copyright Microsoft 2003

Overview

What is DNS?

External and Internal Namespaces

DNS Zone Types

Stub Zones And Conditional Forwarding

Zone Transfers

Dynamic Updates

Configuring Name Resolution For Client Computers

DHCP Interaction

DNS and Microsoft ® Active Directory ® Application Partitions

What is DNS?

Domain Name Service/Domain Name System

Defines a hierarchical namespace where each level of the namespace is separated by a “.”

Similar to file system paths, but read from right to left

Rightmost portion of a name is most generic, for example,

hostname.subdomain.secondleveldomain.topleveldomain .

“.” indicates namespace root

Leftmost portion of a name is most specific

hostname .subdomain.secondleveldomain.topleveldomain.

Provides resolution of names to IP addresses and resolution of IP addresses to names

What is a DNS Server?

Computer running DNS service

DNS server service is separate from DNS client, even when running on the same computer

Can be:

Microsoft ® Windows ® .NET Server 2003

Windows 2000

Microsoft Windows ® NT 4

UNIX

Linux

NetWare

Etc.

Capabilities vary by operating system and/or DNS server software version

DNS Namespace . msn.com .com corp.microsoft.com. microsoft.com. mtu.edu .edu msu.edu .org unicef.org gov.au .au com.au Subdomain Second-Level Domain Top-Level Domain Root corp. microsoft. com .

Fully Qualified Domain Name (FQDN)

Identifies a host’s name within the DNS namespace hierarchy

Host name plus DNS domain name = FQDN

If referencing only a domain, no host component

Host name DNS domain name

Resolver

Computer that requests DNS resolution

Issues queries that ask for specific types of mappings of computers and IP addresses ( records )

Query types determine behavior of DNS server receiving query

Lookup types determine whether a name-to-IP mapping or an IP-to-name mapping is sought

Query and Lookup Types The DNS server returns an answer to the query or a pointer to other DNS servers Iterative query The DNS server returns a complete answer to the query, not a pointer to another DNS server Recursive query Query Types Requests name-to-address resolution Forward lookup Requests address-to-name resolution Reverse lookup Lookup Types

Recursive Queries

A query made from a client to a DNS server in which the server assumes the full workload

DNS server returns either a complete answer or negative

Issued by:

Client computers

DNS servers configured to use forwarder(s)

Iterative Queries

Receiving server may return an answer, a negative response, or a referral to other DNS server(s)

Typically issued by DNS servers not configured to use forwarders for resolution of queries

“Walk” the DNS tree

“Give me an answer or refer me to somebody else who can help me obtain resolution.”

How DNS Works Preferred DNS Server: 10.1.1.1 http://server1.microsoft.com Recursive Query: server1.microsoft.com. Is name in cache? No Am I authoritative? No Is name in cache? No Cache response Is name in cache? No Is name in cache? No Am I authoritative? Yes Cache response 10.1.1.1 Root Server Root Hints: b.root-servers.net [128.9.0.107] j.root-servers.net [198.41.0.10] k.root-servers.net [193.0.14.129] l.root-servers.net [198.32.64.12] m.root-servers.net [202.12.27.33] i.root-servers.net [192.36.148.17] e.root-servers.net [192.203.230.10] d.root-servers.net [128.8.10.90] a.root-servers.net [198.41.0.4] h.root-servers.net [128.63.2.53] c.root-servers.net [192.33.4.12] g.root-servers.net [192.112.36.4] f.root-servers.net [192.5.5.241] Iterative Query: server1.microsoft.com. To: Root Servers Am I authoritative? Delegation: .com. = a.gtld-servers.net [192.5.6.30] g-gtld-servers.net [192.42.93.30] c.gtld-servers.net [192.26.92.30] i.gtld-servers.net [192.36.144.133] b.gtld-servers.net [203.181.106.5] d.gtld-servers.net [192.31.80.30] l.gtld-servers.net [192.41.162.30] f.gtld-servers.net [192.35.51.30] j.gtld-servers.net [210.132.100.101] k.gtld-servers.net [213.177.194.5] e.gtld-servers.net [192.12.94.30] m.gtld-servers.net [202.153.114.101] I don’t know. Ask: a.gtld-servers.net [192.5.6.30] g-gtld-servers.net [192.42.93.30] c.gtld-servers.net [192.26.92.30] i.gtld-servers.net [192.36.144.133] b.gtld-servers.net [203.181.106.5] d.gtld-servers.net [192.31.80.30] l.gtld-servers.net [192.41.162.30] f.gtld-servers.net [192.35.51.30] j.gtld-servers.net [210.132.100.101] k.gtld-servers.net [213.177.194.5] e.gtld-servers.net [192.12.94.30] m.gtld-servers.net [202.153.114.101] TLD Server Iterative Query: server1.microsoft.com. To: TLD Servers Am I authoritative? Delegation: microsoft.com. = dns2.cp.msft.net [207.46.138.21] dns1.cp.msft.net [207.46.138.20] dns1.tk.msft.net [207.46.232.37] dns2.tk.msft.net [207.46.232.38] dns3.uk.msft.net [213.199.144.151] dns4.uk.msft.net [213.199.144.152] dns3.jp.msft.net [207.46.72.123] dns4.jp.msft.net [207.46.72.124] dns1.dc.msft.net [207.68.128.151] dns2.dc.msft.net [207.68.128.152] dns1.sj.msft.net [207.46.97.11] I don’t know. Ask: dns2.cp.msft.net [207.46.138.21] dns1.cp.msft.net [207.46.138.20] dns1.tk.msft.net [207.46.232.37] dns2.tk.msft.net [207.46.232.38] dns3.uk.msft.net [213.199.144.151] dns4.uk.msft.net [213.199.144.152] dns3.jp.msft.net [207.46.72.123] dns4.jp.msft.net [207.46.72.124] dns1.dc.msft.net [207.68.128.151] dns2.dc.msft.net [207.68.128.152] dns1.sj.msft.net [207.46.97.11] microsoft.com DNS Servers Iterative Query: server1.microsoft.com. To: microsoft.com DNS servers server1.microsoft.com=192.168.7.99 server1.microsoft.com=192.168.7.99 http/tcp session- 192.168.7.99 192.168.7.99 10.1.1.1 Root Server TLD Server microsoft.com DNS Servers 192.168.7.99 http://server1.microsoft.com server1.microsoft.com=192.168.7.99 http/tcp session- 192.168.7.99 Recursive Query: server1.microsoft.com.

Root Hints

IP addresses of DNS servers that are considered authoritative for the root of the DNS namespace

Used by DNS servers to determine which DNS servers are considered the root (“.”) servers (for iterative queries)

13 default root servers are part of any DNS installation

Can replace Internet root servers with internal DNS servers to shape DNS traffic within an organization

Forwarders

DNS servers configured to use forwarders send recursive queries to listed addresses when they cannot resolve queries themselves

By default, will fall back to iterative queries if forwarder fails to return answer

Can disable

Do not use recursion setting disables further attempts to resolve names when forwarders fail

Conditional Forwarding

Windows Server 2003 DNS servers can be configured to forward to different DNS servers based on the suffix queried

Allows for granular configuration of forwarders instead of requiring all forwarding to go to the same server(s)

Zone

Portion of DNS namespace for which an entity (company, organization) is responsible

May be divided up into multiple zone files hosted on multiple DNS servers

Subdomains

Divisions within a DNS domain, used to divide namespace further

Stored on same DNS server(s) as parent domains unless delegated

Delegated subdomains

Stored on separate DNS servers from parent domains

Parent DNS servers maintain records that point to servers hosting the subdomains

Delegation (Delegated Subdomain)

Used by a DNS server that receives an iterative query for a subdomain

DNS server that has knowledge of the delegation returns the IP address(es) of the authoritative server(s) for the subdomain in response to iterative queries

Internet DNS namespace is comprised of a series of delegations, for example root servers have delegations for top-level domains, top level domains have delegations for second-level domains, etc.

Subdomains and Delegated Subdomains

Subdomains

All records for the zone are stored locally

Delegated subdomains

DNS server storing delegation information only has records of DNS servers that are authoritative for the zone

Zone File

Text file

Contains resource records

Portion of DNS namespace for which a particular server is responsible

A server that hosts a copy of a zone file is said to be authoritative for that zone, meaning that it has direct, verifiable knowledge of the records stored in the zone

May not include entire portion of DNS namespace for which an entity (company, organization) is responsible

For example, a server may host only a subdomain of a larger DNS domain

The larger DNS domain is the organization’s zone of authority, but the server is authoritative only for the subdomain

DNS Zone Types- Forward/Reverse Lookup Reverse Lookup DNS Server Forward Lookup Name for 192.168.1.50? Name = nwtraders.msft IP address for nwtraders.msft? IP address = 192.168.1.50 DNS Server

DNS Zone Types - Standard/Active Directory Integrated * Stub Zone data may be stored in text files or in Active Directory, but updates to the zone are always made on DNS server(s) that host a writable copy of the zone Standard Zones Primary Zone Secondary Zone Stub Zone* Change Zone Transfer Standard Queries Glue NS SOA Only Active Directory Integrated Zones Change Change Change Replication

Active Directory Integrated DNS Zones

Only available on DNS servers that are also domain controllers

Not stored in text files

Records stored as objects in Active Directory

Have ACLs (Access Control Lists) and owners

Replicate as part of Active Directory replication

Eliminate single point of failure (unless only one DC/DNS server hosts the zone)

Can have standard secondary servers in addition to replicating partners

Any server hosting the zone as an Active Directory integrated zone can write to the zone (multi-master writes)

Stub Zones

New in Windows Server 2003

Server hosting a stub zone is not authoritative for the zone

Only has SOA, NS and glue records (host records for DNS servers that are authoritative for zone), if necessary

Glue records are host records identifying DNS servers for a zone

Populates records via iterative queries to authoritative DNS server(s)

Stub Zones

Can only be created on Windows Server 2003 DNS servers (whether or not the DNS server is a domain controller)

A DNS server hosting a copy of a stub zone is not authoritative for the zone

Stub zones give a DNS server enough information for it to be able to use iterative queries to resolve names in the zone, but not all of the information in the zone itself

Configuring Zones

A DNS server can host primary zones, secondary zones, stub zones, or any combination of zones

A primary server or a secondary server can be designated as a master server for a secondary zone

A stub zone is populated via standard iterative queries to authoritative server(s) for the zone

DNS Server A DNS Server B DNS Server D DNS Server C Secondary Zone (Master DNS Server = DNS Server B) Secondary Zone (Master DNS Server = DNS Server A) Primary Zone Stub Zone (Authoritative DNS Servers = DNS Servers A & C) Zone Transfer Zone Transfer A B C D Standard Queries Standard Queries

Demonstration

Creating Standard Primary Zone

Creating Active Directory Integrated Zone

Configuring Conditional Forwarding

Start of Authority Records

Record that contains configuration information about zone

Version (serial) number of zone

Primary server for zone

E-mail address of person responsible for zone

“ @” is substituted for first “.”

for example, hostmaster.dot.dotnet = hostmaster@dot.dotnet

Secondary refresh parameters

TTL information

Resource Record

Stored in a DNS zone file

May map

Name to IP (A for IPv4, AAAA for IPv6)

Name to another name (CNAME)

IP to name (PTR)

DNS servers (NS)

Mail servers (MX)

Start of Authority servers (SOA)

Services to names, IPs, etc. (SRV)

Various other

Service Resource Records

Identify services running on computers (typically domain controllers)

LDAP servers

Global Catalog servers

Kerberos servers

Domain controllers

PDC Emulators

Registration both with a site association and without

Used by client computers to locate closest server offering service

Name Server - Standard DNS Zone

Primary Name Server

Server that has the only writable copy of the text file storing records for a given zone

Single point of failure in standard DNS implementation

Secondary Name Server

Read Only Copy of Primary Zone

Master Name Server

Server that transfers zone file information to a secondary DNS server

Zone Transfer

Process by which DNS servers hosting standard copies of DNS zones pass zone updates to one another

Master-secondary relationship

Receiving DNS servers are always secondary

Master may be primary or secondary (secondaries can transfer to other secondaries)

AXFR- Full zone transfer

IXFR- Incremental zone transfer

Zone Transfer Process

A zone transfer is initiated when

A master DNS server sends notification of zone changes to the secondary server or servers

The secondary server queries a master DNS server for changes to the zone file

Zone 1 Primary Zone Database File Secondary Zone Database File nwtraders.msft support.nwtraders.msft training.nwtraders.msft DNS Server DNS Server (Master)

Zone Transfers

IXFR- Incremental Zone Transfers

Only records that have changed since last zone transfer are sent

AXFR- Full Zone Transfers

Entire zone is transferred from master DNS server to secondary

If either master or slave (secondary) is not capable of IXFR, then AXFR occurs

Demonstration

Creating Resource Records

Configure Zone Transfers

Configuring Name Resolution for Client Computers IP address can be provided by a DHCP server or manually configured DNS server addresses can be provided by a DHCP server or manually configured

Overview of Dynamic Updates Local name server Server that is authoritative for name Client Result (zone name and authoritative server’s name and IP address) Find authoritative server Result (success or failure) Attempt dynamic update

Configuring a DNS Server to Allow Dynamic Updates to a Zone

None

Does not accept dynamic updates

Nonsecure and secure

Accepts dynamic updates from unauthenticated and authenticated entities

Secure only

Only available for Active Directory-integrated zones

Only allows dynamic updates from authenticated entities

Does not allow modification of record by entity that does not own or does not have permission to modify

DHCP Registration of DNS Records For clients capable of dynamic update (Windows 2000, Windows XP, Windows .NET Server 2003) DHCP server registers PTR record and client registers A record by default DHCP server registers both PTR and A record regardless of client request DHCP removes A record when it removes PTR record from DNS For legacy clients that cannot perform dynamic update

DNSUpdateProxy Group

When a DHCP server registers records on behalf of clients (for example, downlevel clients), by default the DHCP server is the owner of the record

If client subsequently attempts to modify its record(s) (for example, if a legacy client is upgraded to an operating system capable of dynamic update), it cannot because it is not the owner of the record

Making DHCP servers members of the DNSUpdateProxy group configures them to register the records with no owner

First security principal to “touch” the record becomes its owner

Facilitates downlevel clients “taking over” maintenance of their own DNS records when they’re upgraded

Potential security risk

DHCP Interaction

New in Windows .NET Server 2003

Allows DHCP server to be configured to register records as a specific security principal instead of as itself

Configurability of Registering Account

Group Policy Settings for Client DNS Configuration

Group Policy, which is a function of an Active Directory environment, can be used to configure DNS parameters on computers that are members of an Active Directory domain and are running Windows 2000 or later

Active Directory Replication Partitions

Logical divisions in an Active Directory database

Domain controllers that host a replica of a partition will participate in Active Directory replication of the information stored in that partition

Domain controllers that are also DNS servers may participate in replication of DNS data stored in partitions in Active Directory

DNS Application Partitions

Replication scopes for Active Directory integrated DNS zones

Can replicate to every domain controller in a single Active Directory domain, regardless of whether or not all DCs are running the DNS service

Can replicate to every domain controller in a single Active Directory domain that is running the DNS service

Can replicate to every domain controller in the Active Directory forest that is running the DNS service

Can create administratively-defined replication scopes

Domain Partition

Contains domain-specific objects in Active Directory

Users

Computers

Groups

Etc.

In Windows 2000, all DNS zones that were Active Directory integrated were stored in the domain partition for the domain where the zone was made Active Directory integrated

Still an option in Windows .NET Server 2003, but other replication partitions are now available (as soon as the first .NET Server 2003 domain controller is created)

Domain Partition Storage of DNS Zone(s)

Every domain controller for a domain has a replica of the DNS information for an Active Directory-integrated zone stored in the domain partition, regardless of whether the domain controller is also a DNS server

Advantage: can very easily make a domain controller an authoritative DNS server simply by installing the DNS Server service- the domain controller already has all of the zone information stored in its replica of the Active Directory database

Disadvantage: domain controllers that are not running the DNS service are replicating DNS information

Domain Partition Storage of DNS Zone(s)

Storage of DNS data in a domain partition does not allow Active Directory integration of zones across domain boundaries

Zone can only be Active Directory integrated in one domain*

Domain controllers only store their own domain’s domain partition

Eliminates ability to utilize Active Directory replication mechanisms to propagate zone information to other domains

Can configure DNS servers in other domains as secondary servers for the zone

Zone transfers are the only mechanism to pass the DNS zone information to DNS servers in other domains

*You can configure a zone as Active Directory integrated in multiple domains, but the domain controllers for the individual domains will not replicate DNS information with each other- zones will become unsynchronized

DomainDNSZones