1. Fully Qualified Domain Names FQDNs

2. DNS Database A distributed, hierarchical database Resolves Fully Qualified Domain Names (FQDNs) to IP addresses – Distributed: Each DNS server is responsible (authoritative) for only part of the DNS database – Hierarchical: Organized in levels

3. FQDNs Client1.tech.sales.Company.com. Host.(root)Top Level 2 nd Level Sub-domain FQDNs: The name of the host (the device assigned an IP address) and its location in the DNS “tree” Includes the name of the host and all DNS domains back to the.(root)

4. FQDNs Continued Client1.tech.sales.Company.com. Host.(root)Top Level 2 nd Level Sub-domain Name on the far left is the host The period (.) on the far right represents the.(root) of the DNS “tree”

5. Tips A DNS domain is a section of the DNS “tree.” Do not confuse with an Active Directory domain which is container in AD. Example: Company.com might be one AD domain but it would be two DNS domains.

6. Recap FQDN is the name of the host and its position in DNS tree Host name on the far left.(root) server on the right Every time you cross a period, it’s a different DNS domain

7. Client Name Resolution

8. 1.Cache 2.DNS Server www.yahoo.com

9. Name Resolution Continued Client checks to see if there is an entry in its DNS cache – View the DNS cache: ipconfig /displaydns – Clear the DNS cache: ipconfig /flushdns

10. DNS Cache

11. DNS Cache Continued

12. Hosts File All Windows clients have a Hosts file. Located in the “c:\windows\system32\drivers\etc” folder Should only be edited with Notepad Entries in the Hosts file pre-populate the client DNS cache

13. Hosts File Continued

15. Tips To save changes to Hosts file, open in an elevated copy of Notepad If you flush the DNS cache and an entry remains, check the Hosts file

16. Tips Continued Any time a client needs a different IP for a host than all other clients, use the Hosts file. DNS ServerIntranet.Company.com 192.168.1.10 Intranet.Company.com 192.168.2.10 Production Network Development Network

17. Name Resolution Continued FQDN not in client cache, client forwards query to primary DNS server Client only contacts secondary DNS server if no response from primary

18. Recap Clients check their cache before querying DNS If a client needs a different “answer” than contained in DNS, use the Hosts file

19. Server Name Resolution

20. Name Resolution Continued 1.Cache 2.DNS Server www.yahoo.com 1.Cache 2.Authoritative

21. DNS Server Name Resolution 1.DNS server checks its cache – To clear the DNS server cache use dnscmd /clearcache 2.DNS server determines if it is authoritative for DNS domain – Authoritative servers host the records for the domain

22. Name Resolution Continued 1.Cache 2.DNS Server www.yahoo.com 1.Cache 2.Authoritative 3.Conditional Forwarding

23. Name Resolution Continued 3.DNS server checks for Conditional Forwarding – DNS forward request if it matches a condition, ie: a particular domain name – Example: forward all queries for Microsoft.com to IP address 12.34.56.78 Note: Conditional Forwarding will be covered more in-depth later.

24. Conditional Forwarding

25. Name Resolution Continued 1.Cache 2.DNS Server www.yahoo.com 1.Cache 2.Authoritative 3.Conditional Forwarding 4.Forwarding

26. Name Resolution Continued 4.DNS server checks for Forwarding – Forwards all requests for which server is not authoritative to another DNS server – This may be done for: Security Server is a caching only server: Not authoritative for any domains

27. Forwarding Continued Internal Network Internet DMZ

28. Forwarding Continued

29. Name Resolution Continued 1.Cache 2.DNS Server www.yahoo.com 1.Cache 2.Authoritative 3.Conditional Forwarding 4.Forwarding 5.Root Hints.(root)

30. Name Resolution Continued 5.DNS server uses Root Hints – “Root Hints” tab contains names and IP addresses of all.(root) servers Note: Visit www.root-servers.org for a list and map of all.(root) servers.

31. Root Hints

32. .(root) Servers.(root) servers are authoritative for the.(root) domain.

33. Tips When a DNS server has a.(root) zone “Forwarders” and “Root Hints” are disabled.

34. Tips Continued If server hosts a.(root) zone: – “Forwarders” and “Root Hints” disabled – Server will not be able to resolve Internet names – Delete the.(root) zone to resolve names on the Internet

35. Name Resolution Continued 1.Cache 2.DNS Server www.yahoo.com 1.Cache 2.Authoritative 3.Conditional Forwarding 4.Forwarding 5.Root Hints.(root)

36. Name Resolution Continued.(root) servers have delegations for top level domains Delegations identify name and IP address of authoritative DNS server for sub-domain

37. Name Resolution Continued 1.Cache 2.DNS Server www.yahoo.com 1.Cache 2.Authoritative 3.Conditional Forwarding 4.Forwarding 5.Root Hints.(root).com IN NS dns.com dns.com IN A 34.56.78.90

38. Name Resolution Continued 1.Cache 2.DNS Server www.yahoo.com.(root) yahoo.com IN NS dns.yahoo.com dns.yahoo.com IN A 56.12.34.78 dns.com

39. Name Resolution Continued 1.Cache 2.DNS Server www.yahoo.com.(root) yahoo.com IN NS dns.yahoo.com dns.yahoo.com IN A 56.12.34.78 dns.com dns.yahoo.com www.yahoo.com IN A 56.12.34.78

40. Name Resolution Continued 1.Cache 2.DNS Server www.yahoo.com.(root) yahoo.com IN NS dns.yahoo.com dns.yahoo.com IN A 56.12.34.78 dns.com dns.yahoo.com www.yahoo.com IN A 56.12.34.78 56.12.34.78

41. Name Resolution Continued DNS server obtains the IP address and stores it in server cache Forwards IP to client Client stores it in client cache Client initiates contact using IP address

42. Tips Hosts only communicate using IP addresses DNS only matches host names to IP addresses; it is not used in the actual communication If you can ping a computer by IP address but not by name, the problem is DNS

43. Recap Servers resolve names by: 1.Cache 2.Authoritative 3.Conditional Forwarding 4.Forwarding 5.Root Hints

44. Recap Continued For Internet resolution: use Forwarding or Root Hints – Internet name resolution not working, check for and delete.(root) zone DNS servers have delegations used to locate authoritative servers lower in the database

45. Conditional Forwarding and Stub Zones

46. Name Resolution Continued Corp.Company.comInt.Partner.com Corp.Company.com and Int.Partner.com are not resolvable from the Internet. After a company merger, clients in each forest must be able to resolve names in the other forest.

47. Name Resolution Continued Corp.Company.comInt.Partner.com Since the domains are not resolvable using Root Hints, the DNS servers in each forest must be configured to directly contact the DNS servers in the other forest.

48. Name Resolution Continued In a complicated forest, DNS resolution can become challenging. Suppose clients in C.B.A needed to resolve names for resources in E.D.A. C.B.A B.A A D.A E.D.A

49. Name Resolution Continued A B.A C.B.A D.A E.D.A

50. Name Resolution Continued A B.A C.B.A D.A E.D.A

51. Name Resolution Continued A B.A C.B.A D.A E.D.A

52. Name Resolution Continued C.B.A B.A A D.A E.D.A It would be faster if DNS servers in C.B.A could send requests right to the DNS servers in E.D.A.

53. Stub Zone Copy of the zone that contains only DNS server records

54. Conditional Forwarding Pro: does not require permission. Pro: no transfer of records. Con: static.

55. Stub Zones Con: does require permission. Con: some transfer of records. Pro: dynamic.

56. Recap Conditional Forwarding/Stub Zones used to: – Resolve domains not available through.(root) – Speed up internal name resolution in complex AD Conditional Forwarding (+no permission, +no transfer of records, -static) Stub zones (-needs permission, -minimal transfer of records, +dynamic)