Windows Forum

Ask something
Discussion Locked

DNS Help

0 helpful
19 replies

by kingofthenerds

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi all,

I have been working with Windows 2000 Server now for quite some time and still don't understand how DNS works.

Yes i understand that is resolves names, and that you can foward dns requests onto external DNS servers but i have many blanks in between.

I have come into a network running Windows 2000 Server and it has 95, 98, 2000 and XP clients. It also has Mac OS 9 and 10 clients who are given IP addresses by our DHCP server but maintained by a Mac 10.2.8 server.

The problem is that i don't know how to troubleshoot DNS to see if it is working correctly, how to add records or when i need to add records.

I looked at how our DNS is setup and i believe it is wrong although i am not sure.

It has a Cached Lookups entry .
It has a Foward lookup zone (ourdomain.edu.au)
It has reverse lookup zones
0.in-addr.arpa
127.in-addr.arpa
14.168.192.in-addr.arpa
255.in-addr.arpa
I believe that the reverse lookup should be our ip address scheme backwards like so
1.168.192.in-addr.arpa
Isn't this right instead of whats there, please will someone fully explain this DNS to me and how to set it up, including all details, hand typed, not a stupid link and don't bother putting in a paragraph of information because your wasting both our time.

I will award all my points to whoever can explain DNS and how i should set it up.

19 replies

by p.j.hutchison

Three tools are needed to troubleshoot dns, one is NSlookup, Ipconfig and Ping.
You are correct that it will resolve names to computer names. Whenever a name is used e.g. Outlook, IE, SQL etc, the DNS server can resolve it to an IP address which is then used to communicate to the destination server. These are plain Host or 'A' records.
If using a Windows 2000 domain and enabled Dynamic registration then you do not need to manually add entries for computer names, its done for you. For special entries you need to do it manually.
Any DNS records in cannot resolve are auto passed onto the next DNS servers you specify in the DNS Server Properties e.g. ISP DNS, if the ISP cannot find it, it'll pass it on and so on.
In the Forward Look up Zone you will have entries for each kind of network e.g. 192.168.14.x, 127.x.x.x and so on and an equivalent for reverse lookups (resolve IP addresses back to DNS names), this can be tested using PING -a ipaddress.

Your DNS looks ok although there are more properties you didn`t mention. The root zone (.) can be removed if you need to fwd dns to other dns servers.

There are some good KB articles you can read:
http://support.microsoft.com/default.aspx?scid=kb;en-us;300202&Product=win2000
http://support.microsoft.com/default.aspx?scid=kb;en-us;317590&Product=win2000
http://support.microsoft.com/default.aspx?scid=kb;en-us;200525&Product=win2000

by curlergirl

DNS is complicated and can't be fully explained in a simple paragraph. However, here are some specifics that might help you with your current problem:

First of all, your reverse lookup zone has to be your network address backwards. So, if your network is 192.168.14.x, then your current reverse lookup zone is correct. If your network address is 192.168.1.x, then your reverse lookup zone should be 1.168.192.in-addr.arpa, as you said. The other reverse lookup zones that you describe are unnecessary, but they aren't doing any harm.

On a Windows 2000 Server, assuming your DNS server is AD-integrated and that you have dynamic DNS updating turned on, your Windows 2000 and XP workstations will automatically register themselves with your DNS server(s), so no manual entries are required. However, older OS's and Mac OS's can't do dynamic DNS updating. Microsoft claims that you can do dynamic updating for older clients by enabling your DHCP server to send automatic updates to your DNS server, but I've never been able to get this to work. So, barring that, you'd have to make manual entries to your forward and reverse lookup zones for your Win9x and Mac clients. For your purposes, you'd probably only have to make one entry for each client - an A record, which is a basic host record. When you add the host record in your forward lookup zone, there is a checkbox to have the system automatically create the PTR (reverse lookup) record at the same time.

As far as troubleshooting, if you open the DNS management console, you can set up debug and event logging by right-clicking the server name and going to Properties. There are tabs to set up both types of logging there. Be careful of debug logging, though - the file can become very large very quickly on a busy network. Also, you can do a basic test of your forward and reverse zones by going to the Monitoring tab and running the simple tests that are available there.

(continued below)

by curlergirl

If you need to test name resolution for specific machines, use nslookup. Open a command prompt and type "nslookup" (without the quotes) and then the name of the host machine you want to find. This will tell you if name resolution is working properly and if that machine is properly registered with your DNS server. If you want to go more deeply into nslookup and how to use it, look it up in the Windows Help information - this will give you a general idea of who it works and the commands and subcommands you can use with it.

This pretty much covers simple DNS for a private, internal zone. If you need to go into a wider view of DNS on the Internet dealing with root servers, primary and secondary zones, public DNS servers, etc., you will need to look it up yourself on the Internet or get a good book on how DNS works.

Hope this helps!

by kingofthenerds

ok,
you guys are on the right track, but you have not explain some of the concepts such as:
what is a foward zone
what is a reverse zone
what happens if each one is not working
Because obviously my reverse lookup is wrong, i have a network on 192.168.1.* not 192.168.14.*. So what sort of trouble would this be causing, why haven't i noticed anyone not being able to do certain things on the network.

Ok, also i tried nslookup and put in our proxy servers name, it then proceeded to lookup the Mac DNS server and failed.

In my DNS tab on the DHCP server, the mac technician who was here has put the Mac server DNS as the top address, and the Windows DNS server as the bottom, as follows:
192.168.1.15
192.168.1.4

Ok, so i bet you will tell me put the windows DNS server first in the list, but what will that do to the mac clients trying to find DNS.

Also why hasn't the nslookup command tried the second entry for a dns server, please help

Thanks

by kingofthenerds

Ok, so i thought i only had trouble looking for the name of the proxy E.g nslookup proxy
I have now tried to nslookup 192.168.1.3 which is the address for our proxy. It replied the following:
Server: "mac server name"
Address: 192.168.1.15

"mac server" could not find 192.168.1.3:non existent in the domain

Please help me, this is obviously in bad shape.

by kingofthenerds

I have just done the nslookup command from a Mac running 10.2.8 and if i put the IP address of the Mac server it finds it. But if i put in the address of another machine on the netork it returns "mac server name, which is in the form of "server.com.au" can't find the 192.168.1.140 non existent host/domain
server: "mac server"
address: 192.168.1.15

by kingofthenerds

Ok,

So with what i have been reading a . (root) zone should not be installed. If it is your fowarders won't work, is this true. If so why the hell do i have a . (root) zone.

Should i right click the zone, and left click delete or will this have bad effects on the network.

By the way i have made a new reverse lookup zone,
1.168.192.in-addr.arpa and made it active directory intergrated, is this good?

I also changed the DNS lookup order in the DHCP server but nothing changed when i did a nslookup. Do i have to restart the server or is the problem with going to the mac servers dns something completely different?

If someone can help me out not only will i gladly give all these points but i will be very grateful, think of me as a mind trying to learn and with just a few nudges i could be completely on the right track.
Thanks

by curlergirl

Ok - let me try to address your comments one at a time:

Your forward lookup zone resolves host name and type to IP address. In your forward lookup zone, you have each host name listed with its record type and IP address. You also have some SOA (start of authority) and NS (name server) records that define your DNS servers and their roles. There are a number of record types, such as A (host) records, CNAME (alias) records, MX (mail server) records, etc. The forward lookup zone provides resolution of host name to IP address.

The reverse lookup zone is used to provide IP address to host name lookup. In your reverse lookup zone, you'll see SOA and NS records, and then PTR records that list the IP address first and then the host name. In most cases, internally on your network, you won't notice any problems if your reverse lookup zone isn't working properly. This is because most if not all browsing on your network is done by host name, not IP address.

I don't know why your Mac guy would have put his DNS server's IP address first - it may be a Mac DNS thing. At any rate, it appears that your Mac DNS server is not configured correctly either. Or, perhaps your Macs are not using that proxy server and therefore don't need name resolution for that server, or they use it but they are configured to connect to it by IP address. Not knowing anything about Macs, I really can't answer that question. The Windows workstations get their DNS settings from the DHCP scope options on your DHCP server, not from the server's own IP address, so they wouldn't be affected. The Macs may be connecting to your DHCP server through some sort of RAS connection, however, in which case they would be getting their DNS from the RAS server settings. This gets pretty complicated, and I can't address it here. I think you need to talk to your Mac guy directly and find out why he put his DNS server as primary.

(cont'd)

by curlergirl

As to why the nslookup didn't try the secondary (Windows) DNS server, the way DNS requests work, as long as the primary DNS server responds, the lookup will always go there. It will only go to the secondary if the primary is unavailable for a period of time.

Given the above comments about the Mac DNS server, you need to test your Windows DNS resolution on the Windows DNS server, or (if it's the same server as the DHCP server) on one of the Windows workstations. The nslookup tool is designed to test name resolution. So, to test your forward lookup zoine, you need to use the host name, not the host IP address. If your host name is macserver, then your nslookup to see if that name is resolvable would be: nslookup macserver. To test the reverse lookup zone, you use the IP address. The fact that your reverse lookups are not working indicates that your reverse lookup zone on the Mac DNS server (which is the primary one on the machine you are using for the lookup) is not configured properly. If you want to test a particular DNS server, type: nslookup - [DNS servername] (without the brackets). You should get a response from the DNS server with its name and IP address. Then at the next prompt, type your host name (to test name resolution) or IP address (to test reverse lookup). Again, to test your Windows DNS server, you need to do it from a Windows workstation or other server that has that DNS server as its primary; or use the nslookup - [DNS servername] to specify what server you want to test.

(cont'd.)

by curlergirl

Since the reverse lookup from the Mac machines to other hosts on the network is failing, it is obvious that the Mac DNS server has no (or an improperly configured) reverse lookup zone. Try a lookup on a host name instead to see if it works - it should, but if it doesn't then your Mac DNS server it pretty much useless as far as I can tell.

You say you added a correctly configured reverse lookup zone on your Windows DNS server - that is good. But you have to have PTR records in that zone for it to be doing anything. You will need to either manually create these, or you will need to wait until the dynamically registered machines renew their registrations so that the records are added automatically.

As to the root zone question - this is OK IF your internal DNS zone is different (has a different name) from your public domain AND if you have a proxy server or router that is using public DNS servers for name resolution when your workstations go out to the Internet. If all of this is working properly, don't mess with it. However, if you are having any external name resolution problems, I would recommend starting over. This would involve deleting your current zones and creating completely new forward and reverse lookup zones that are authoritative for your internal domain but are NOT configured as root servers. In order to create a zone that is authoritative but NOT a root zone, you create the zone and then simply remove the "." entry from the forward lookup zone.

Now, I've spent a good deal of time on this answer, and I hope it helps you, but I still recommend that you get some good reading material on DNS and educate yourself further. You may find a lot of stuff that doesn't apply to your current situation, but you will also find a lot that does.

by kingofthenerds

Look you have helped me understand a little better but i still have the following problem:
I go to cmd prompt , type nslookup 192.168.1.4 which is the windows 2000 DNS server location and it replies:
"mac server name, which is in the form of "server.com.au" can't find the 192.168.1.4 non existent host/domain
server: "mac server"
address: 192.168.1.15

Also you said i need to add PTR records? How do i do this and what do i point them towards? What are they for?

If you can help me out with these problems and direct me to some easy reading, then i will award you the points for your time

Thankyou

by trx-0

Hi
Ok not going for the points just a bit of info from my side.
If you install a dns server through dcpromo it will configure itself as a root server and thus you won't be able to use forwarders or root hints.
to remove a root dns zone:
start/admistrative tools/dns
in the snap-in expand the dns server (click +)
expnd forward lookup zones
delete the . (dot)representing the root server.
hope it helps
steve

by curlergirl

You are trying to look up by using the IP address of your Windows server: 192.168.1.4. The DNS server that is responding is the one that is set as your primary DNS server, which is your mac server. So, the first part of the response is:

server: server.com.au
address: 192.168.1.15

This indicates that your mac DNS server is up and running and responding to your query. The second part of the response is:

server.com.au can't find 192.168.1.4: Non existent host/domain

This indicates that there is no record on this server (server.com.au) for that address. Since your lookup is in the form of an IP address, the DNS server will query on the basis of a reverse DNS record, which is also called a pointer or PTR record. The fact that your server can't find a record based on that IP address indicates to me that the reverse lookup zone on that server (server.com.au) is non-existent or not properly configured. At the very least it confirms that there is no PTR record on that server for the host machine that has the address 192.168.1.4.

(cont'd.)

by curlergirl

The records in a reverse DNS zone are called PTR records; a reverse DNS zone contains ONLY PTR records. I am not familiar with Mac DNS servers, so I can't tell you how to add them to a Mac server, but to add PTR records to a Windows DNS server:

1. Open the DNS Management Console.
2. Navigate to the reverse lookup zone. If there isn't one, right click on the server name, click New Zone and follow the prompts in the dialog boxes. When it asks you for the network ID, type 192.168.1. When you finish, you will have a new reverse lookup zone listed as 192.168.1.x Subnet. This will already have the top level records for your DNS servers created.
3. To add records, right click on the reverse lookup zone name (192.168.1.x) and click New Pointer.
4. Fill in the last digit of the IP address and the host name for each machine for which you want to add a reverse lookup record.

Again, remember that you don't actually HAVE to have a reverse lookup zone for a private, internal Windows network. The only reason you would need it is if there are programs or devices on your network that have to be found by browsing the IP address of the host rather than by the host name.

As for reading, here's a link to the Microsoft DNS technologies website. There are a lot of technical articles, how-to's, white papers and even webcasts on this site that might be helpful to you. Browse around a bit and find the ones that fill in the gaps in your knowledge.

http://www.microsoft.com/windows2000/technologies/communications/dns/default.asp#section5

Hope this helps!

This discussion is closed to new replies.