Lesson 4: Configuring the DNS Service

Once the DNS Service is installed, you can configure it by using the DNS snap-in. When you start the DNS snap-in for the first time, a wizard appears and guides you through the process of configuring the following options:

• A root name server
• A forward lookup zone
• A reverse lookup zone

You can also use the DNS snap-in to add additional entries, called resource records, to the zone database file and to configure the DNS Service for Dynamic DNS (DDNS), which enables automatic updates to your zone files by other servers or services.

When you start the DNS snap-in for the first time, a wizard appears and provides you the option of configuring the server as a root name server. Root name servers store the location of name servers with authority for all the top-level domains in the domain name space (for example, the com domain). These top-level name servers can then provide a list of name servers with authority for the second-level domains (for example, the microsoft.com domain).

Configure a root name server for your intranet only when the following conditions apply:

• You are not connecting to the Internet. Therefore, the root level domain is for your intranet only.
• You are using a proxy service to gain access to the Internet. You are creating the root of your local DNS domain name space, and the proxy service will do the translation and connection necessary to access the Internet.

A forward lookup zone enables forward lookup queries. On name servers, you must configure at least one forward lookup zone for the DNS Service to work.

To create a new forward look up zone, right-click the Forward Lookup Zone folder, and a wizard guides you through the process. The wizard presents the following configuration options: Zone Type, Zone Name, and Zone Database File Name.

There are three types of zones that you can configure:

• Standard Primary. A standard primary zone is the master copy of a new zone and is stored in a standard text file. You administer and maintain a primary zone on the computer at which you create the zone.
• Standard Secondary. A standard secondary zone is a replica of an existing zone. Secondary zones are read-only and are stored in standard text files. A primary zone must be configured in order to create a secondary zone. When creating a secondary zone, you must specify the DNS server, called the master server, which will transfer zone information to the name server containing the standard secondary zone. You create a secondary zone to provide redundancy and to reduce the load on the name server containing the primary zone database file.
• Active Directory Integrated. An Active Directory Integrated zone is the master copy of a new zone. The zone uses directory services based on Active Directory technology to store and replicate zone files.

Typically, a zone is named after the highest domain in the hierarchy that the zone encompasses—that is, the root domain for the zone. For example, for a zone that encompasses both microsoft.com and sales.microsoft.com, the zone name would be microsoft.com.

The zone database file name defaults to the zone name with a .DNS extension; for example, if your zone name is microsoft.com, the default zone database file name is microsoft.com.dns.

When migrating a zone from another server, you can import the existing zone file. You must place the existing file in the systemroot\System32\DNS folder on the target computer before creating the new zone.

A reverse lookup zone enables reverse lookup queries. Reverse lookup zones are not required. However, a reverse lookup zone is required to run troubleshooting tools, such as Nslookup, and to record a name instead of an IP address in Internet Information Services (IIS) log files.

To create a new reverse lookup zone, right-click the Reverse Lookup Zone folder in the DNS snap-in, and a wizard guides you through the process. The wizard presents the configuration options described in the following sections.

For the zone type, select Standard Primary, Standard Secondary, or Active Directory Integrated, as defined above.

Enter your network ID and subnet mask; for example, an IP address of 169.254.16.200 and a subnet mask of 255.255.0.0 would result in a network ID of 169.254. All reverse lookup queries within the 169.254. network are resolved in this new zone.

The network ID and subnet mask determine the default zone file name. DNS reverses the IP octets and adds the in-addr.arpa suffix. For example, the reverse lookup zone for the 169.254 network becomes 254.169.in-addr.arpa.dns.

When migrating a zone from another server, you can import the existing zone file. You must place the existing file in the systemroot\System32\DNS directory on the target computer before creating the new zone.

Once you create your zones, you can use the DNS snap-in to add resource records. Resource records are entries in the zone database file. To add a resource record, right-click the zone to which you want to add the record, click New, and then select the type of record that you want to add.

There are many different types of resource records. When a zone is created, DNS automatically adds two resource records: the Start of Authority (SOA) and the Name Server (NS) resource records.

Table 3.4 describes these records, along with the most commonly used resource records.

Table 3.4 Types of Resource Records

Resource record	DNS Snap-in name	Description
SOA	Start of Authority	Identifies which name server is the authoritative source of information for data within this domain. The first record in the zone database file must be the Start of Authority record.
NS	Name Server	Lists the name servers that are assigned to a particular domain.
A	Host	Lists the host name-to-IP-address mappings for a forward lookup zone.
PTR	Pointer	Points to another part of the domain name space. For example, in a reverse lookup zone, it lists the IP-address-to-name mapping.
SRV	Service	Identifies which servers are hosting a particular service in a single query operation. For example, if a client needs to find a server to validate logon requests, the client can send a query to the DNS server to obtain a list of domain controllers and their associated IP addresses.
CNAME	Alias	Creates an alias, or alternate name, for the specified host name. You can use a canonical name (CNAME) record to use more than one name to point to a single IP address. For example, you can host a File Transfer Protocol (FTP) server, such as ftp.microsoft.com, and a Web server, such as www.microsoft.com, on the same computer.
MX	Mail Exchanger	Identifies which mail exchanger to contact for a specified domain and in what order to use each mail host.
HINFO	Host Information	Identifies the central processing unit (CPU) and operating system used by the host. Use this record as a low-cost resource-tracking tool.

The DNS Service includes a dynamic update capability called Dynamic DNS (DDNS). With DNS, when there are changes to the domain for which a name server has authority, you must manually update the zone database file on the preferred name server. With DDNS, name servers and clients within a network automatically update the zone database files.

You can configure a list of authorized servers to initiate dynamic updates. This list can include secondary name servers, domain controllers, and other servers that perform network registration for clients, such as servers running the DHCP Service or the Microsoft Windows Internet Name Service (WINS).

DDNS interacts with the DHCP Service to maintain synchronized name-to-IP-address mappings for network hosts. By default, the DHCP Service allows clients to add their own A (Host) records to the zone, and the DHCP Service adds the PTR (Pointer) record to the zone (see Figure 3.6) when the client leases the IP address. The DHCP Service cleans up both the A (Host) and PTR records in the zone when the lease expires.

Figure 3.6 Dynamic DNS updates the zone database when IP addresses change

Use the DNS snap-in to configure a zone for DDNS as follows:

1. From the DNS snap-in, right-click the forward or reverse lookup zone that you want to configure, and then click Properties.
2. On the General tab, under Dynamic Update, click one of the following options:

• None. Do not allow dynamic updates for this zone.
• Allow Updates. Allow all dynamic DNS update requests for this zone.
• Allow Secure Updates. Allow only dynamic DNS updates that use secure DNS for this zone.

The Allow Secure Updates option only appears if the zone type is Active Directory Integrated. If you click Allow Secure Updates, the requestor's permission to update the records in the zone database is tested by using mechanisms specified in a subsequent secure DNS update protocol.

In this practice, you will create a forward lookup zone, create a reverse lookup zone, and configure the DNS Service to allow Dynamic DNS.

In this exercise, you will configure the DNS Service by creating a forward lookup zone and a reverse lookup zone.

1. Click Start, point to Programs, point to Administrative Tools, and then click DNS.
2. Click your server in the console tree.

Information about configuring the DNS server appears in the details pane.

3. From the Action menu, select Configure The Server.

The Configure DNS Server wizard appears.

4. In the Configure DNS Server wizard, click Next.
5. On the Root Server page, ensure that the This Is The First DNS Server On This Network option is selected, and then click Next.
6. On the Forward Lookup Zone page, verify that Yes, Create A Forward Lookup Zone is selected, and then click Next.

The Zone Type page appears.

7. Verify that the Standard Primary option is selected, and then click Next.

The Zone Name page appears.

8. Type domain.com and then click Next.

The Zone File page appears.

9. Ensure that the Create A New File With This File Name option is selected and that the name of the file to be created is domain.com.dns.

10. Click Next.
11. On the Reverse Lookup Zone page, verify that Yes, Create A Reverse Lookup Zone is selected, and then click Next
12. On the Zone Type page, verify that the Standard Primary option is selected, and then click Next.
13. On the Reverse Lookup Zone page, ensure that the Network ID option is selected, and type 192.168.1 in the Network ID box.

If you are on a network and did not use 192.168.1.201 as your IP address, type in the first three octets of your static IP address. This should be the same IP address that you used in step 7 of the "To configure TCP/IP for DNS" procedure in Exercise 1 in Lesson 3.

14. Click Next.

The Zone File page appears.

15. Ensure that the Create A New File With This File Name option is selected and that the name of the file to be created is 1.168.192 in-addr.arpa.dns.

16. Click Next.

The Completing The Configure DNS Server Wizard page appears.

17. Review the information on the Completing The Configure DNS Server Wizard page, and then click Finish.

If you used the suggested name and IP address, your information should match the information shown in Figure 3.7.

Figure 3.7 Lookup zone information upon completing the Configure DNS Server wizard

In this exercise, you will configure the DNS Service to allow dynamic updates.

1. In the console tree, expand Server1.

2. Expand Forward Lookup Zones, expand Domain.com, right-click Domain.com, and then click Properties.

The Domain.com Properties dialog box appears.

3. In the Allow Dynamic Updates? drop-down list on the General tab, click Yes, and then click OK.

This configures Dynamic DNS for the forward lookup zone.

4. Expand Reverse Lookup Zones, and expand 192.168.1.x Subnet.

5. Right-click 192.168.1.x Subnet, and then click Properties.

The 192.168.1.x Subnet Properties dialog box appears.

6. In the Allow Dynamic Updates? drop-down list on the General tab, click Yes, and then click OK.

This configures the Dynamic DNS for the reverse lookup zone.

1. In the console tree, click Reverse Lookup Zones.
2. Click 192.168.1.x Subnet.

What types of records exist in the reverse lookup zone?

3. In the console tree, right-click 192.168.1.x Subnet, and then click New Pointer.

4. In the Host IP Number box, type in the selected octet, 201, of your IP address.

5. In the Host Name box, type the fully qualified domain name of your computer, followed by a period. In our example, if your computer name is Server1, type server1.domain.com. Remember to include the trailing period.
6. Click OK.

A Pointer record appears in the details pane.

7. Close the DNS tool.

In this exercise, you will confirm that your DNS Service is working.

1. Open a command prompt.
2. At the command prompt, type nslookup and then press Enter.

Record your results in the following table.

Parameter	Value
Default server
Address

Answers

3. Type exit and then press Enter.
4. Type exit and press Enter to close the command prompt.

You can configure the DNS Service by using the DNS snap-in. When you start the DNS snap-in for the first time, a wizard appears and guides you through the process of configuring a root name server, a forward lookup zone, and a reverse lookup zone. Root name servers store the location of name servers with authority for all the top-level domains in the domain name space, and the top-level name servers can provide a list of name servers with authority for the second-level domains. In the practice portion of this lesson, you configured your DNS Service by creating a forward lookup zone and a reverse lookup zone.

You can also use the DNS snap-in to add additional entries, called resource records, to the zone database file and to configure the DNS Service for Dynamic DNS (DDNS), which enables automatic updates to your zone files by other servers or services.