IT Employment

Ask something
Discussion Locked

DNS Setup

0 helpful
4 replies

by billc124 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have some questions about setting up DNS on a Win2K Server. Currently we have no internal DNS servers, all our workstations point to our ISP's DNS servers for Name Resolution. We are planning on Upgrading our DC's to Windows 2000 Server so we can run Active Directory and Exchange 2000. We are planning this in phases, upgrading the Windows NT 4 Primary DC first, then a few weeks later the NT 4 Backup DC. I have some issues with how to setup DNS on the Win2k Box. What if anything do I need to keep in mind. I know that I need to enable forwarding on the DNS server in order to resolve External Names, but what I am reading says that I need to delete the Root DNS zone on the DNS server, if I do that, does that limit my ability to resolve internal names. I am new to DNS and this is the only major roadblock that I am running into with this. Does anyone else out there work for a smaller company with the same kind of setup. Any insight would be appreciated. I am planning on doing the first upgrade on Sunday and would like as much info as possible by then.

Thanks.

4 replies

by ebob

Deleting the root zone is correct, except it will prevent you from resoving EXTERNAL names. This is because your DNS will not know where to turn for names that are not part of your "internal domain". If you leave the root zone in place, your internal domain will be broadcast on the Internet which is its own sets of challenges.

So what to do?

Simple. The DNS server you describe is your domain's "primary". Also setup a secondary. Leave the root zone. Make this secondary to your primary foryour internal domain (or zone, if you like to call it that). Then point your clients to the secondary.

The effect will be: when your users want an internal address and if the name/address is not in your secondary's cache, the secondary will look to the primary for that zone, and update its own cache. If your user is looking for any other address not in the cache on your server, it will go out to the Internet, and again, update its own cache.

by billc124

That kind of makes sense. I guess what I am wondering is if I delete the Root Zone and setup a forwarder on the Primary to send all names that it can't resolve to my ISP's DNS servers, will I still be able to resolve internal names as well? That is the main question I have at this point. Down the road I will be setting up another DNS server, but at this time, that is not for a couple of months. If deleting the root zone and enabling forwarding will work for me, than that is what I think is the best plan of attack at this point.

by ebob

I would be "concerned" that my internal zone files will be replicated out to the Internet. I perceive this as being a security exposure by providing too much information to the bad guys.

This discussion is closed to new replies.