Learn Active Directory Design and Administration in 15 Minutes a Week: Microsoft DNS - Part 3

Monday Jun 23rd 2003 by Jason Zandri
Share:

This latest installment in Jason Zandri's 'Learn Active Directory Design and Administration in 15 Minutes a Week' further examines DNS under Windows 2000 Server and how it relates to the support of Active Directory design.

Welcome to the 21st installment of "Learn Active Directory Design and Administration in 15 Minutes a Week," a weekly series aimed at IT professionals preparing to write the new Windows Active Directory Design and Administration exams (70-219 and 70-217 respectively), as well as newcomers to the field who are trying to get a solid grasp on this new and emerging directory service from Microsoft.

This installment further examines DNS under Windows 2000 Server and how it relates to the support of Active Directory design.

[NOTES FROM THE FIELD] -- I recently received e-mail asking how I am going to address in Active Directory articles the changes that have been implemented in Windows Server 2003. For the time being, the main course of these articles will continue to focus on the 70-217 and the 70-219 exams.

DNS Zone Overview

A DNS zone is a contiguous portion of the domain namespace for which a particular DNS server has authority to resolve DNS queries. DNS namespaces are almost always divided into zones that store name information about one or more DNS domains or portions of a DNS domain(s).

The Windows 2000 Active Directory domain structure contains three zone types.

The Standard Primary zone has a read/write version of the zone file that is stored in a standard text file. Any changes to the zone are recorded only in that file. Any other copies of that zone are Secondary zone copies and are read-only.

The Standard Secondary zone contains a read-only version of a Primary zone file stored in a standard text file. Any changes to the zone are performed on the Primary zone file and replicated to the Secondary zone file. To create a copy of an existing Primary zone and its zone file (which allows the DNS name resolution workload to be distributed among multiple DNS servers), you must create a Standard Secondary zone. Standard Secondary zones are also used when hosting DNS servers to implement load balancing and fault tolerance for DNS name resolution in your environment.

[NOTES FROM THE FIELD] -- There is fault tolerance under the Standard Primary/Secondary model; when a single server becomes non-responsive or is altogether offline, name resolution will still occur because at least one other server is available to respond to queries. It's possible, however, for the Standard Primary zone to become unavailable for any reason. The entire time that the DNS that hosts the Standard Primary zone is down, there will be no way for updates to be made to the zone, as the only read/write copy of the zone (Standard Primary) will be unavailable.

The Active Directory integrated zones store the DNS zone information in the Active Directory database rather than in a text file. Updates to the Active Directory integrated zone occur automatically during Active Directory replication. You do not need to manually configure DNS servers to specify update intervals, as Active Directory maintains the zone information and replicates the information based on its own replication schedule.

The Active Directory integrated option is not available in the Change Zone Type dialog box until Active Directory is implemented. If Active Directory is not present in the environment, the option will be grayed out in the New Zone Wizard and the Change Zone Type dialog box from the DNS MMC.

DNS Zone Transfer Overview

In most cases, DNS client systems are configured to use more than one DNS server. This allows for fault tolerance for name resolution. The main issue with local zone records is that information held by one DNS server may not be available on another. This is especially true where Standard Primary and Standard Secondary zones are concerned.

When a new DNS server hosting a Standard Secondary zone is first added to the network, it must execute a full zone transfer (AXFR) to obtain a complete copy of resource records for the zone so that it is up to date with other Standard Secondary DNS servers (and the Standard Primary DNS server) on the network.

[NOTES FROM THE FIELD] -- Windows NT 4.0 DNS and the DNS services that are available for systems running BIND version 8.1 and earlier always performed full zone transfers (AXFR), as they were unable to execute any other type of transfer.

DNS services on Windows 2000 Server and DNS BIND versions 8.1.2 and later support the incremental zone transfer (IXFR) process, which allows for the replication of just the changes to the DNS zone information rather than the forcing the replication of the entire DNS zone.

Incremental Zone Transfers

The incremental zone transfer (IXFR) process is detailed in RFC 1995 (http://www.jhsoft.com/rfc/rfc1995.txt). This replication process provides a quicker method of propagating zone changes and updates, as the incremental transfer process normally causes much less network traffic due to smaller amounts of data being passed during the update process.

When Windows NT 4.0 DNS and the DNS services that are available for systems running BIND version 8.1 make a request zone update, they require a full transfer of the entire zone database using an AXFR query -- even if only a single record has changed.

IFXR for DNS implementations that can use it allows for Standard Secondary servers to pull only the differences in the DNS zones it needs from another DNS server so its local copy of the zone matches up.

Differences between DNS zones are determined via the serial number field in the SOA resource record of each zone. If the serial number for one zone is higher than the serial number of the requesting Secondary Server, a IXFR transfer is made of only the differences to resource records.

That wraps up this installment of "Learn Active Directory Design and Administration in 15 Minutes a Week." As always, if you have any questions, comments, or even constructive criticism, feel free to drop me a note. I want to write solid technical articles that appeal to a wide range of readers and skill levels, and it is only through your feedback that I can be sure I am doing that.

Until next time, best of luck in your studies and remember:

"Love is blind, but marriage is a real eye-opener."

Share:
Home
Mobile Site | Full Site
Copyright 2017 © QuinStreet Inc. All Rights Reserved