1. DNS Zones

2. DNS records kept in zones DNS server is authoritative for a domain if it hosts the zone for that domain Sub-domains can be kept in same zone as long as they are contiguous – Example: west.Company.com can be kept in the same zone as Company.com.

3. DNS Zones Continued Zones are either “Forward Lookup” or “Reverse Lookup” – “Forward Lookup” zones resolve FQDNs to IP addresses – “Reverse Lookup” zones resolve IP addresses to FQDNs

4. FQDNs vs IP Addresses Client1.company.com 192.168.1.10/24

5. Tips “Reverse Lookup” zones are written backwards. This zone would provide IP to FQDN name resolution for the 192.168.1.0 network.

6. Tips Continued The DNS server in an nslookup command is listed as “UnKnown” unless you create a reverse lookup zone.

7. DNS Zones Continued There are two main types of zones that can be created: – Standard zones – Active Directory Integrated zones

8. Recap DNS Records kept in zones “Forward lookup:” Name to IP “Reverse lookup:” IP to name – Written backwards Each can have either Standard or Active Directory Integrated (ADI) zones

9. Standard Zones

10. Standard zones kept in text files in %systemroot%\system32\dns named domain name.dns.

11. Standard Zones Continued Two types of Standard zones: – Standard Primary: only read/write copy of the zone – Standard Secondary: read-only, used for fault tolerance and load balancing.

12. Standard Zones Continued Modifications to Standard zones must be made on the Primary Clients can only update records by contacting the Primary Updates to the Primary are sent to the Secondary using zone transfers

13. Zone Transfers Two triggers for zone transfers: – Refresh Interval – DNS Notify Zone transfers: – Require permission – Always initiated by the Secondary zone

14. Zone Transfers Continued

17. Best security: “Allow zone transfers:” “Only to the following servers” Second choice: “Allow zone transfers:” “Only to servers listed on the Name Servers tab” Avoid “Allow zone transfers:” “To any server”

18. Zone Transfers Continued The “Name Servers” tab lists authoritative DNS servers

19. Zone Transfers Continued 1.Secondary requests a copy of Primary’s “Start of Authority” (SOA) record – “Serial number:” starts at 1 and increments to infinity 2.If “Serial number:” on Primary is higher than Secondary’s, Secondary initiates zone transfer

20. Zone Transfers Continued

21. Zone transfers are in clear text. The only way to secure them would be a “Connection Security Rule” (IPSec)

22. Recap Standard Primary – only read/write Standard Secondary – read only Primary transfers changes to Secondary using zone transfers: – Need permission for copy of zone – Initiated by Secondary server – Not secure

23. Active Directory Integrated Zones ADI

24. Active Directory Integrated Zones (ADI) ADI zones store DNS in Active Directory – Only created on Domain Controllers – Changes exchanged through AD replication – No permission needed Three main benefits: – Multi-master – Secure “zone transfers” – Secure dynamic updates

25. ADI Continued

27. Tips Active Directory is a multi-master database: all copies of zone accept updates Any time clients must update records at more than one location requires ADI

28. ADI Continued DNS info transferred using replication, which is encrypted. “Zone transfers” automatically secure

29. ADI Continued Dynamic updates allow clients to update DNS records Secure Dynamic Updates record the SID of the client on the DNS record – Only that client can update record Secure Dynamic Updates can only be enforced on ADI zones To limit Dynamic Updates to domain members, allow only Secure Dynamic Updates

30. ADI Continued

31. Four replication scopes: – “To all DNS servers running on domain controllers in this forest.” – “To all DNS servers running on domain controllers in this domain.” – “To all domain controllers in this domain.” – “To all domain controllers in the scope of this directory partition.”

32. Tips DNS info must be stored on less than all of DCs in domain, create a directory partition – Can also be created using ntdsutil

33. ADI Continued

34. Replication scope of “To all domain controllers in the scope of this directory partition,” must create new partition in AD Then, select which Domain Controllers receive a copy

35. ADI Continued Create partition: dnscmd /createdirectorypartition Specify which DCS have a copy: dnscmd /enlistdirectorypartition

36. ADI Continued

37. Recap ADI zones store DNS in Active Directory – Only created on Domain Controllers – Changes exchanged through AD replication – No permission needed Three main benefits: – Multi-master – Secure “zone transfers” – Secure dynamic updates

38. Recap Continued Four replication scopes: – “To all DNS servers running on domain controllers in this forest.” – “To all DNS servers running on domain controllers in this domain.” – “To all domain controllers in this domain.” – “To all domain controllers in the scope of this directory partition.” Less than all DCs in Domain