Windows Server 2003 DNS jefflms 11 hinet net

Windows Server 2003 DNS 安裝設定與管理維護 林寶森 jeffl@ms 11. hinet. net

What Is a Domain Namespace? Root Domain Top-Level Domain net Second-Level Domain Subdomains com org nwtraders west FQDN: server 1. sales. south. nwtrader s. com south sales east Host: server 1

Overview of the DNS Query Process Query Types Iterative Query Recursive Query The DNS server returns the best answer that it can provide without help from other servers The DNS server returns a complete answer to the query, not a pointer to another DNS server Lookup Types Forward Lookup Requires name-to-address resolution Reverse Lookup Requires address-to-name resolution

How Recursive Queries Work A recursive query is a query made to a DNS server, in which the DNS client asks the DNS server to provide a complete answer to the query DNS server checks the forward lookup zone and cache for an answer to the query Recursive query for mail 1. nwtraders. co m 172. 16. 64. 11 Computer 1 Database Local DNS Server

How Iterative Queries Work An iterative query is a query made to a DNS server in which the DNS client requests the best answer that the DNS server can provide without seeking further help from other DNS servers. The result of an iterative query is often a referral to another DNS server lower in the DNS tree Iterative Query Rec ma ursiv il 1. n e q wtra uery der for s. co 172 m. 16. 64. 11 Local DNS Server Computer 1 Ask Iter. com ative Root Hint (. ) Query As nwtra k ders. c Iteroam tive Auth Que orita ry tive Res pon se . com nwtraders. com

How Root Hint Works Root hints are DNS resource records stored on a DNS server that list the IP addresses for the DNS root servers Corp. or ISP DNS Servers Inter. NIC Root (. ) Servers Root Hints Local DNS Server Computer 1 com microsof t

How Forwarders Work A forwarder is a DNS server designated by other internal DNS servers to forward queries for resolving external or offsite DNS domain names Iterative Query Root Hint (. ) Ask Iter. com ative Q. 11 Ask n w . 16. 64 17 2 Re cu rsi ve Qu ery Forwarder 172. uery tive orita 16. 6 4. 11 Rec u mail rsive qu 1. nw e trad ry for ers. c Local om DNS Server . com Itera Auth . com trader s tive Que ry Res pon se nwtraders. com Computer 1

What Is a DNS Zone? Nwtraders South West Sales North Support Training

What Are DNS Zone Types? Zones Read/Write Description Read/write copy of a DNS database Primary Read-Only Read-only copy of a DNS database Secondary Copy of limited records Stub Copy of a zone containing limited records

Selecting Zone Data Location Standard Zones Zone Transfer Change Primary Zone Secondary Zone Active Directory Integrated Zones Zone Transfer Change

Configuring Standard Zones • You can configure a DNS server to host standard primary zones, standard secondary zones, or any combination of zones • You can designate a primary server or a secondary server as a master server for a standard secondary zone DNS Server A DNS Server B B A Primary Zone Informati on Secondary Zone (Master DNS Server = DNS Server A) DNS Server C C

What Are Resource Records and Record Types? Record type Description A Resolves a host name to an IP address PTR Resolves an IP address to a host name SOA The first record in any zone file SRV Resolves names of servers providing services NS Identifies the DNS server for each zone MX The mail server CNAME Resolves from a host name to a host name

Zone Transfer Process A Zone Transfer is Initiated When – A master DNS server sends notification of zone changes to the secondary server or servers – The secondary server queries a master DNS server for changes to the zone file DNS Server (Master ) Primary Zone Database File support nwtraders Secondary Zone Database File training Zone 1

Configuring Zone Transfers • Zone Transfer Types – Full zone transfer (AXFR) – Incremental zone transfer (IXFR) • Configuring Zone Transfer Properties Serial number: Increment 2 Refresh interval: Retry interval: Expires after: 15 10 1 Minimum (default) TTL: 0 • Configuring DNS Notify minutes days : 1 : 0

Configuring Zone Transfers nwtraders. msft Properties WINS General Zone Transfers Start of Authority (SOA) Serial number: 28 Primary server: london. contoso. com Responsible person: Security nwtraders. msft Properties Name Servers General Start of Authority (SOA) Name Servers Zone Transfers WINS Security Increment A zone transfer sends a copy of the zone to requesting servers. Allow zone transfers Browse… To any server Browse… admin. contoso. com Refresh interval: 15 minutes Retry interval: 10 minutes Expires after: 1 days : 1 : 0 TTL for this record: : 1 : 0 OK Only to the following servers IP address: Add Remove Minimum [default] TTL: 0 0 Only to servers listed on the Name Servers tab To specify secondary servers to be notified of zone updates, click Notify. Cancel Notify… Apply OK Cancel Apply

How DNS Notify Works A DNS notify is an update to the original DNS protocol specification that permits notification to secondary servers when zone changes occur Destination Server 3 4 Secondary Server Resource 1 record is updated 2 SOA serial number is updated DNS notify Source Server Zone transfer Primary and Master Server

Configuring AD Integrated Zones • Active Directory Integrated Zone Data Is – Stored as an Active Directory object – Replicated as part of domain replication Active Directory Integrated Zone Active Directory contoso. co m DNS Server

What Are Directory Partitions? Contains: Definitions and rules for creating and manipulating objects and attributes Forest Schema Information about the Active Directory structure Configuration Domain <Domain> Configurable replication <Application> Active Directory Database Information about domain -specific objects Information about applications

Selecting a Partition Forest Application Domain Partition

Configuring Dynamic Updates • DNS Dynamic Update Protocol – Allows clients to automatically update DNS servers – Can be used in conjunction with DHCP 1 Request for IP address Windows client updates forward resource record on DNS server 2 Assign IP address of 192. 168. 120. 133 DHCP updates reverse resource record for Windows 2000, XP and 2003 clients and both resource records for other clients Computer 1 192. 168. 120. 133 DNS Server DHCP Server Zone Database

Securing Dynamic Updates nwtraders. msft. Properties WINS General Active Directory Integrated Zone Transfers Start of Authority (SOA) Status: Running Type: Active Directory-integrated Security Name Servers Pause Change… Data is stored in Active Directory. Allow dynamic updates? Secure Dynamic Updates Only secure updates To set aging/scavenging properties, click Aging OK Aging… Cancel Apply

Creating a Subdomain • Create a Subdomain to Better Organize Your Namespace • Delegate Authority of a Subdomain To – Delegate management of portions of the namespace – Delegate administrative tasks of maintaining one large DNS database “. ” org. com. edu. tw. microsoft. com. training. microsoft. com. Subdomain. Second-Level Domain. Top-Level Domain Root

DNS Server Roles Role Situation Caching-only servers A remote office has a limited amount of available bandwidth Non-recursive servers You have Internet-facing DNS that are authoritative for one or more zones Forward-only servers You want to manage the DNS traffic between your network and the Internet Conditional forwarders You want DNS clients in separate networks to resolve each others’ names without having to query the DNS server on the Internet

How the Time-to-Live Value Works The Time-to-Live (TTL) value is a time-out value expressed in seconds that is included with DNS records that are returned in a DNS query Resource Record Cach e DNS Client 1 2 3 Resource Record Cach e DNS Server 1 Zone Authoritative DNS Server 2 TTL set on the zone The records in the zone are sent to other DNS servers and clients in response to queries DNS servers and DNS clients that store the record in their cache hold the record for the TTL period supplied in the record When the TTL expires, the record is removed from the cache

Reducing Network Traffic by Using Caching-Only Servers – Perform name resolution on behalf of client computers and cache the results – Can be used to reduce DNS-related traffic across a WAN Remote Office Client Caching-Only DNS Server Slow WAN Link DNS Server Client Corporate Headquarters Client

How Aging and Scavenging Works 7 -days Jan 1 Time stamped 7 -days Jan 8 No. Refresh interval Jan 15 Refresh interval Aging Scaven ge

What Is DNS Debug Logging? DNS debug logging is an optional logging tool for DNS that stores the DNS information that you select Primary DNS Server 1 Secondary DNS Server 2

Planning a DNS Implementation • Small Companies – Can use ISP DNS servers for queries and to store company domain names • Larger Companies – Maintain their own DNS servers • Two DNS Servers Recommended – Primary name server – Secondary name server

DNS Namespace Options Same Namespace Existing DNS Namespace nwtraders. co m Internal Namespa ce nwtraders. co m Delegated Namespace Existing DNS Namespace nwtraders. co m Internal Namespa ce ad. nwtraders. com Unique Namespace Existing DNS Namespace nwtraders. co m Internal Namespa ce nwtraders. lo cal

Connecting DNS to the Internet Internal DNS Server External DNS Server Firewall Internet Firewall Screened Subnet § Forwarding DNS Queries to Internet DNS Servers § Responding to DNS Queries from the Internet DNS Server

Integrating DNS into Screened Subnets public. contoso. msft Primary DNS Zone public. contoso. msft Secondary DNS Zone Firewall Private Network Internet Firewall Screened Subnet n Zones Contain Records for Public Resources n Configure Firewalls to Permit Appropriate DNS Traffic n Place Only Secondary Zones n Encrypt Replication Traffic with IPSec