This chapter is from the book
This chapter is from the book
This chapter is from the book
DNS Planning Considerations
Before you actually install DNS, you must first analyze your current network and determine your name-resolution requirements. The areas of planning include the following:
Site structure
Types of name servers
Types of network clients
Naming hosts and domains
Static IP addresses
Site Structure
The structure of your physical network plays an important role in the design of your DNS infrastructure. How you choose to implement DNS will be different depending on your setup. For example, you wouldn't have the same configuration for a single site with a couple of DCs as you would where you had multiple sites connected by WAN links with multiple DCs in each location.
The concept of sites is discussed in Chapter 12, "Active Directory Replication," but for our purposes here, we will define a site to be an IP subnet that is well connected (all hosts in the site have at least a 10Mbps Ethernet connection between them). A common problem with enterprise network environments with many sites connected by WAN links is bandwidth utilization. The DNS name-resolution process involves queries against a DNS database, and at times of high network utilization, this traffic can place an extra burden across the WAN links. In this type of situation, it is recommended that you place DNS servers at each site so that name-resolution traffic does not have to cross the lower-bandwidth links.
CAUTION
When presented with exhibits of existing networks, you need to be able to determine how to set up DNS for those various environments.
Types of Name Servers
Different types of name servers need to be considered. In this section, we cover the following:
Primary DNS servers
Secondary DNS servers
Caching-only DNS servers
Forwarding DNS servers
AD integrated servers
Primary DNS Servers
There are really two main types of non-AD DNS servers: primary servers and secondary servers. As briefly mentioned earlier, the DNS namespace is partitioned into what are known as zones. We discuss zones in detail in the "DNS Zones" section later in this chapter, but for now just understand that a zone is the part of the overall DNS namespace that is controlled by a primary server. There can only be one primary server in a zone, and that primary server is said to be authoritative for the zone. It is the master, and any changes to the DNS domain must be made on the primary server.
Secondary DNS Servers
A secondary server is essentially a backup server for the primary server. Note that during the name-resolution process, if a primary server cannot resolve a host name, the query is not submitted to a secondary server (if one exists in the zone). The secondary server is used as a failover if the primary server fails. If a client is unable to contact the primary DNS server, it attempts to use the secondary server if one has been configured. Another potential use of a secondary server is load-balancing. If you have 1,000 network clients, for example, you could configure half of them to use the primary server first and half of them to use the secondary server first. This would reduce the load on the primary server.
Changes are never made directly to a secondary server, which receives a copy of the master zone file from the primary name server in a zone. This process is called zone transfer and is covered in more detail in the "Zone Transfer" section, later in this chapter. Unlike with primary servers, a zone can have multiple secondary servers.
Caching-Only Name Servers
This type of name server does pretty much what the name implies—it functions only to cache queries. The caching-only name server does not maintain a zone database file, nor does it receive updates from a primary server. It simply performs queries, caches the results, and returns results to querying clients. You can use caching-only name servers to deploy DNS services to sites that you do not wish to have an editable copy of the DNS zone.
The advantage to using a caching-only name server is the reduction in network traffic. The reduction is twofold. First, there is no replication traffic being generated between the primary name server and the caching-only server as there is between a primary and secondary server. Second, a caching-only server reduces name-resolution traffic by reducing the need for subsequent queries to go through the entire name-resolution process.
The disadvantage of caching-only servers, however, is that if a server is rebooted, the cache is flushed; the server must build its cache back up again from scratch.
Caching-only servers can also perform what is called negative caching, which caches failed results. This reduces the timeout process when a client queries for a site that does not exist or is unavailable.
Forwarding DNS Servers
Forwarding DNS servers exist solely to communicate with DNS servers outside the local zone. By default, any DNS server that receives a query it cannot resolve will contact an outside DNS server to resolve the name for the client making the query. A DNS forwarder functions like a proxy, becoming the only DNS server in a zone that can communicate outside the zone. This is similar in concept to a bridgehead server, which improves the utilization of network bandwidth by designating a single server as the contact point to other sites. If the primary name server, for example, cannot resolve a name, it sends the query to the forwarding DNS server for resolution. Figures 3.1 and 3.2 show a DNS infrastructure not using a forwarder and using a forwarder, respectively.
)
Figure
3.1 A DNS zone where all name servers communicate outside of the local zone.
)
Figure
3.2 A DNS zone that uses a forwarding name server to communicate outside
of the local zone.
Forwarding servers can be configured to use either nonexclusive or exclusive mode. In nonexclusive mode, a name server can attempt to resolve a query through its own zone database files if a forwarder cannot resolve the query. In exclusive mode, if a forwarder cannot resolve a query, the server that sent the query to the forwarder does not attempt to resolve the name itself and simply returns a failure notice to the client that originated the request.
AD Integrated Servers
Although the previous types of name servers are what are known as "standard" name server types, Windows 2000 introduces the ability to integrate DNS zones into AD. With AD integrated zones, each DC functions as a primary server and contains an editable copy of the zone. Through multimaster replication, discussed in Chapter 12, AD ensures that each copy of the zone is kept current across all DCs.
AD integrated zones provide the following benefits:
Fault tolerance—Standard zones rely on zone transfers for replication, a process that requires the primary server to send updates to the secondary servers. If a primary server goes offline, there is no way to promote a secondary server to become a primary, and updates do not occur again until the primary server is brought online. With AD integrated zones, there isn't the same single point of failure.
Security—AD integrated zones do not store zone information in a text file as standard primary and secondary zones do, and in addition, zone updates can be set so that only secure updates are allowed.
Integrated replication—Because the DNS zone is integrated into AD, it is replicated through the normal AD replication process. Standard zones would require creating an additional replication topology for DNS.
Types of Network Clients
The types of network clients that you have on your network impact your DNS strategy. If you have all Windows 2000 clients, for example, you can utilize all the features of Windows 2000 DNS, such as dynamic updates and secure updates. Legacy Windows NT and Windows 9X clients can't register their resource records automatically through the dynamic update process. However, Windows 2000 can accommodate these clients if they are Dynamic Host Configuration Protocol (DHCP) clients.
A Windows 2000 DHCP server can register legacy clients on their behalf in DNS by you enabling the Enable Updates for DNS Clients That Do Not Support Dynamic Updates option in the DHCP management console.
Naming Hosts and Domains
It is easy to get spoiled by the ability to create DNS domain names that are lengthy. However, if legacy clients exist or you are operating in mixed mode with NT 4 DCs, you must be aware of the limitations on NetBIOS-created names. Windows 2000 attempts to create a default NetBIOS name at the time you create the DNS domain name; however, you might run into problems with existing domains. NetBIOS names are limited to 14 characters, so if you have an existing NT 4 domain called WINDOWSNETWORK and you attempt to create a new domain called windowsnetwork1.com, the default NetBIOS name will be the same as the aforementioned Windows NT domain, and creation will fail.
CAUTION
You should be comfortable with situations where you have to manage both NetBIOS and DNS domain names.
Static IP Addresses
For obvious reasons, DNS servers must have static IP addresses. If the server you are planning to use for DNS is currently configured as a DHCP client, be sure to assign it a unique static IP address for its subnet before installing the DNS server service. IP addresses are configured through TCP/IP properties within the properties of My Network Places.
Before we get to installing and configuring DNS for AD, we first need to take a moment to expand on the concept of DNS zones.