Read an Excerpt
Chapter 6: Installing and Managing Domain Name Service (DNS)The Domain Name Service (DNS) is mysterious to many Windows NT administrators largely because (as you learned in Chapter 2) DNS is usually considered to be part of the network plumbing. In many organizations, one group of people manages DNS and network services while a separate group manages file, print, and application servers. It's time to lift the cloud of mystery since DNS is a critical part of Windows 2000.
This chapter covers material related to installing and managing DNS for the "Install, configure, and troubleshoot DNS" and the "Manage and monitor DNS" exam objectives. "Configure a DNS client," another subobjective of this chapter's first objective, is covered in Chapter 12, "Installing and Config uring Network Clients."
Why is it so important? Active Directory depends absolutely on DNS, and many important system functions (including Kerberos authentication and finding domain controllers) are now handled through DNS lookups. Windows 2000 clients use DNS for name resolution, too, but they also use DNS to find Kerberos Key Distribution Centers (KDC), global catalog servers, and other services that may be registered in DNS.
In this chapter, you'll get a deeper understanding of how DNS works in general, plus an understanding of how to set up, configure, manage, and troubleshoot DNS in Windows 2000.
DNS FundamentalsThe Domain Name System is a hierarchically distributed database. That's a fancy way of saying that its layers are arranged in a definite order, and that its data are distributed across a wide range of machines. DNS is a standard set of protocols that defines the following:
- A mechanism for querying and updating address information in the database
- A mechanism for replicating the information in the database among servers
- A schema of the database
With DNS, the host names reside in a database that can be distributed among multiple servers, decreasing the load on any one server and providing the ability to administer this naming system on a per-partition basis. DNS supports hierarchical names and allows registration of various data types in addition to the host-name-to-IPaddress mapping used in HOSTS files. By virtue of the DNS database being distributed, its size is unlimited and performance does not degrade much when adding more servers.
The latest version of the Windows 2000 operating system includes a new version of DNS. In addition to the features included in the Windows NT version of the DNS service, the Windows 2000 version adds support for a number of new features (described earlier in Chapter 2).
Servers, Clients, and Resolvers...Oh, My!There are a few terms and concepts you will need to know before installing or managing a DNS server. Understanding these terms will make it easier to understand how the Windows 2000 DNS server works.
DNS Servers Any computer providing domain name services is a DNS server. That being said, not all DNS servers are alike. Earlier implementations of DNS (for example, the popular Berkeley Internet Name Domain, or BIND) were originally developed for Unix, and they handled a fairly small and simple set of RFC requirements.
There is also the concept of primary and secondary DNS servers to consider. A primary DNS server is the "owner" of the zones defined in its database. The primary DNS server has the authority to make changes to the zones it owns. Secondary DNS servers receive a read-only copy of zones. The secondary DNS server can resolve queries from this read-only copy, but cannot make changes or updates. A single DNS server may contain multiple primary and secondary zones.
Any DNS server implementation supporting Service Location Resource Records (SRV RRs, as described in an Internet Draft: "A DNS RR for specifying the location of services [DNS SRV]") and Dynamic Update (RFC2136) is sufficient to provide the name service for Windows 2000-based computers. However, because Windows 2000 DNS is designed to fully take advantage of the Windows 2000 Active Directory service, it is the recommended DNS server for any networked organization with a significant investment in Windows or extranet partners with Windows-based systems.
Clients A DNS client is any machine issuing queries to a DNS server. The client host name may or may not be registered in a name server (DNS) database. Clients issue DNS requests through processes called resolvers.
Resolvers Resolvers handle the process of mapping a symbolic name to an actual network address. The resolver (which may reside on another machine) issues queries to name servers. When a resolver receives information from name servers, it caches that information locally in case the same information is requested again.
When a name server is unable to resolve a request, it may reply to the resolver with the name of another name server. The resolver must then address a message to this new name server in the hopes that the symbolic name will be resolved.
Queries There are two types of queries that can be made to a DNS server: recursive and iterative (we'll discuss the difference shortly).
Root Servers When a DNS server processes a recursive query and that query cannot be resolved from local zone files, the query must be escalated to a root DNS server. The root server is responsible for returning an authoritative answer for a particular domain or a referral to a server that can provide an authoritative answer. Since each DNS server is supposed to have a full set of root hints (which point to root servers for various toplevel domains), your DNS server can refer queries recursively to other servers with the assistance of the root servers. You can also configure a DNS server to contain its own root zone; you might want to do so if you don't want your servers to be able to answer queries for names outside your network....