Windows Forum

Ask something
Discussion Locked

internal dns

0 helpful
8 replies

by shanghai sam

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I ran dcpromo to set up AD and during the install I had the wizard set up DNS for me. I want my DNS zones to be active directory integrated and I want my DNS servers to be root servers authoritative for the root domain at my site. I am using my ISP's DNS as foworders to get to the internet. I have read that I must edit the cache.dns file to make my server a root. Can I just remove the root servers from the root hints tab and add my servers ip address or do I have to edit the cache.dns file? Also is this all I need to do to make my server a internal root server? Should I have set up DNS manualy instead of letting dcpromo do it for me?

8 replies

by timwalsh

I would suggest not attempting to make your server a root server. This will have 2 consequences.

First, this has the effect of saying that your server is authoritative for ALL DNS queries occuring in your domain.

Second, making your server a root server disables your ability to specify forwarders. This happens because calling a server a ROOT means that it is at the very TOP of its DNS structure and therefore there is nowhere else to send a DNS query to.

The better way to do what you want to do is to have all clients point only to your internal DNS server (either through DHCP settings or manually edited DNS settings on each client). You also want your internal DNS server to point only to itself for Primary DNS. Then enable forwarders pointing to your ISP's DNS servers.

The net effect of this will be that all DNS queries referencing internal resources will be answered by your internal DNS server and only those queries that cannot be answered (i.e. for the Internet) will be passed on to your ISP's DNS servers. As long as your internal domain name does not have a top-level PUBLIC Internet root extension (.com, .org, .net, .edu, etc.) for which the servers listed in Root Hints are TRULY authoritative, there is not a problem leaving the Root Hints list as-is.

(continued)

by timwalsh

You want to give a private domain a root extension other than a public one (I personally use .local and have seen others such as .private and .internal). Otherwise you run the risk of causing all sorts of unforeseen problems and error messages. Say for example you name your internal domain "mydomain.com". Even if set up as above, if for any reason your DNS server is not available and cannot answer, since .com is a recognized PUBLIC Internet root, the DNS query would be forwarded to your ISP's DNS server and an Internet-wide search for a server hosting the "mydomain.com" domain would begin. This causes connectivity slow downs and error messages because "mydomain.com" probably doesn't exist on the Internet. What would be worse is if the "mydomain.com" domain name has been publicly registered. In this case you could leave yourself open to litigation for trying to hijack someone else?s domain name. If the domain name includes an root extension other than a public one, then DNS recognizes this and the first DNS server that atttempts to answer the query rejects it.

FYI, You would only set up a private root server if you are NOT connecting to the Internet in any way.

Hope this clears up any misunderstanding.

by shanghai sam

Hi,
What I'm about to describe should have been the default, not sure why it wasn't in your case. simply open up your dns console, right click on the server and select new zone. create an active directory integrated zone, forward lookup and, when prompted, give the name as . - thats a single full stop (or a preiod if you are American). now stop and start the dns server service. When you go back in to the server properties in dns you will see that the root hints tab (which formerly mirrored the contents of your cache.dns file) is now greyed out, and the forwarders tab (previously greyed out) is now open for business. For what it is we've done I suggest you read the help files or hit technet to get a full understanding of what the '.' zone is and does. hope it goes ok....

by beermonster

Hi,
I'm back again to eat humble pie, chas (answer 1) is totally correct. This will teach me to rely on memory rather than trying it out before I write an answer. I will of course be taking my own advice and reconsulting technet on a refresher course.......

by saihib

Stop Netlogon. Configure your computer's TCP/IP stack to point to itself as the preferred DNS server. Restart Netlogon. If you need Internet access do not edit the cache.dns file. When the name server receives a query outside it's zone it uses this file for resolution. Use the DNS snap-in for configuration. I'm not sure what your configuration is now but you'll need to set up a primary zone using your ip address. You can use the MMC to delete unwanted zones but make sure you stop the DNS service first.

by saihib

When you let dcpromo set up DNS it assumes the machine will be looking out on the internet. It's a little easier to set it up yourself if you have a plan.

by curlergirl

You are confusing the terminology "root server" with "authoritative". A "root server", as answer #1 describes, resolves ALL DNS REQUESTS - no forwarders allowed. Now, this might make sense in a very large organization where you have multiple domains and DNS servers and public IP addresses and web sites and T1 lines, etc., and you need more control, but in a small domain it's really more than you want to manage. It could even make DNS resolution fail at times when it shouldn't, since your DNSservers will probably take quite a while to get updated with changes. What is necessary for your DNS server to be "authoritative" for your domain is to have your domain registered and in that registration to give your DNS server's IP address(es) asthe name servers for that domain. Of course, these have to be static public IP addresses. Now - make sure that you are not confusing an internal domain (with a private IP addressing scheme) with a public domain (i.e., your ".com" domain). If yourinternal addressing scheme is private, then your internal DNS server cannot be "authoritative" for the domain unless it has an external IP address and resolves ALL public IP addresses for your domain (i.e., including any web servers, etc.). This means it is published on the web and cannot be behind a firewall that blocks DNS queries. If you're not hosting your own web site(s), my advice is to let your ISP's DNS servers be authoritative for your public domain, and have your own internal DNS servers resolve DNS requests only for your internal clients.

by curlergirl

This is a lot more secure for you, since your DNS server will not be published on the web and can be behind your firewall, thus keeping your internal domain private. This is done simply by setting up your internal DNS server as you've described you've already done (with an internal IP address) with your ISP's DNS servers as forwarders. Leave the root hints as they are - they're not doing any harm, because the forwarders will take over anyway for anything that's not in your local cache. Set all of your clients to use your internal DNS servers as primary and secondary and you should be fine. Hope this helps!

This discussion is closed to new replies.