Active Directory DNS questions

N

netsider

Limp Gawd
Joined
Oct 12, 2004
Messages
466
I've read a ton of stuff on DNS over the time I've been a student... but I still don't feel I fully understand it like the back of my hand, like I need to. I know it links domains to IP addrsses and is used more for static IP assignment than dynamic because obviously you don't want names with dynamic IP's, etc. I understand the theory and textbook knowledge of it, but not the real world application (I wish it was the other way around).

Anyways... I've been experimenting with active directory domain services and DHCP/DNS. DHCP, I get. DNS... not so much. I get what it does, but I don't understand anything other than that, and it seems like since I don't know the basics, it's been hard to Google or find other information on it to go deeper into the subject.

1. What is a record? Is a record a certificate for the DNS server or something? Is it where DNS keeps the mappings of IP addresses to DNS names? Also, why do other types of servers (besides DNS servers) have DNS records?

2. Is there anyway to see what IP/DNS mappings/links that the server contains? Like a database of them?

3. Does the DNS server "pre-load" the DNS names, or does it just provide lookup? I'm assuming SOME server must contain a huge table of them, or else other servers couldn't even look them up from a main server if it didn't contain it.

Thanks guys :confused:
 
DNS is a service that runs on a server. (You can choose to install it or not). Active directory needs a DNS to connect to, but doesn't necessarily have to be on the same server. In very simple terms it's just name and IP address mapping.

A record is just that. If you think of it as a database it is just a row that contains an IP address, a hostname and any other relevant information for that individual record. A DNS server can contain hundreds to thousands of records.

DNS is not just for static names. If you are using DHCP and Active directory, computers can have the authority to update their own DNS record on a server.

For example if there is a record on DNS for PC1 with an IP address of 10.0.0.1. If PC1 optains a new IP address of 10.0.0.2 through DHCP, it can contact the DNS server and update the record for itself and point to the new IP address.

If you're using windows server, and DNS is installed there is a console available. Using the GUI it's under administrative tools in the start menu and is just called DNS. Alternatively there are other ways to view DNS.

Individual machines can cache DNS records depending on how your network is setup. They will attempt to contact the DNS servers if they do not have a record for a particular request. The DNS server doesn't really "preload" them because it's already sitting on them.
 
What do the two computers running DNS that I have setup contain in terms of DNS records, though? Every site in the entire world, or just DNS names on the LAN? I'm assuming it has just the DNS names of computers in the domain/network, but I'm just asking to make sure.

Also, I meant is there anyway to view the actual listings of IP addresses and the domain names link to them. I know you can configure DNS from administrative tools. I was mainly wondering if I could see anything in "real time" like what addreses were currently being requested for, or resolved, etc...

I understand what you're saying.. and you gave lots of good info... thanks for that.

What does it mean for "a client to upgrade it's own DNS records?" I'm assuming it means if their IP changes because of DHCP, they can update their record on the DNS server so it'll point to the new address?

Thanks...any additional info is good, too. Take care...

Edit: Nevermind about the part about a client updating it's own records. I overlooked that in your post, where you explained it.
 
Generally only addresses for the domains you have specified. In most cases a DNS server will have other DNS's it will redirect a client to if it does not have the information the client is requesting.

For example, if a client is trying to ping google. The client will first go to your domains DNS server. The DNS server will not have the information the client is looking for (unless you've inputted it). So the server will point the client to another DNS server that may have the information it requires. E.g you may have your server configured to point to your ISP's DNS server. And if the ISP can't provide the info you require it will go higher up again.

To see real time DNS traffic you'll need a packet sniffing tool. Google it and try a few different ones out. I've used wireshark before and it's done for what I needed but it may not have all the info you're after. You can filter results to show only DNS packets etc. I've used it before to test DHCP and you can see the DHCP broadcast, request and ACK packets so it can be pretty handy.

edit: Should probably mention, tools like wireshark can look pretty overwhelming when you first use them. But have a play for a while and you'll soon get the hang of what it's doing.
 
terrabyte89 said:
Generally only addresses for the domains you have specified. In most cases a DNS server will have other DNS's it will redirect a client to if it does not have the information the client is requesting.

For example, if a client is trying to ping google. The client will first go to your domains DNS server. The DNS server will not have the information the client is looking for (unless you've inputted it). So the server will point the client to another DNS server that may have the information it requires. E.g you may have your server configured to point to your ISP's DNS server. And if the ISP can't provide the info you require it will go higher up again.
Click to expand...

You are slightly off on this, the client only queries the DNS servers it knows the one listed in the DNS tab on your windows computer, or resolve.conf on your linux box. If the DNS server has already been asked for the information it will have it in it's cache. If not then the DNS server queries up the chain to the root nameservers. The Root Name server then queries the TLD name servers, who query the Authoritative nameservers. Then they pass the info back down the chain.
 
I think you're over thinking this. DNS is painful to get right but it's a fairly basic concept. Terabytes initial explanation is pretty accurate.

Tower 1 asks local DNS server for IP address www.awesome.stuff, local DNS doesn't know that IP so it asks it's DNS server, usually use you a forwarder that you know is up all the time, like Googles or OpenDNSs DNS servers. Then your local server will contact them and see if they know what IP it's using, and if they don't know, they do the same thing on up the chain.

The entire point of DNS is to not have to know every IP for everything and it works really well for that. But and this is a big But and I cannot lie, you can really easily screw up DNS and if it's messed almost nothing will work. I've done it to myself in the past and it can be a real bitch to figure out what you did wrong.
 
ianshot said:
You are slightly off on this, the client only queries the DNS servers it knows the one listed in the DNS tab on your windows computer, or resolve.conf on your linux box. If the DNS server has already been asked for the information it will have it in it's cache. If not then the DNS server queries up the chain to the root nameservers. The Root Name server then queries the TLD name servers, who query the Authoritative nameservers. Then they pass the info back down the chain.
Click to expand...

Yes, apologies. Don't know why I wrote client retrieving it, the DNS server resolves the address and passes it back.
 
The topic of DNS is great for interview questions. I start with the basic concepts and work my way up the chain, and it really helps distinguish then men from the boys.
  1. How would you explain DNS to someone who wasn't technical? (Comparing it to a phone book is the best answer I've received).
  2. What's an A record? CNAME record?
  3. What's the difference between a forward lookup and a reverse lookup? What if one fails and not the other?
  4. Why would you use a FQDN vs. not?
  5. Why would you or would you not use ping or nslookup? The difference?
  6. What's the difference between "server1.example.com" and "server1.example.com." (note trailing period - 98% of candidates can't answer this correctly).
Anyway, back to the original question. OP, setup a basic DNS server with VirtualBox or something and start to play around with it. While not ideal, a Windows 2003/2008 box will be the easiest to start with. That will get you down the road of familiarizing yourself.
 
REDYOUCH said:
The topic of DNS is great for interview questions. I start with the basic concepts and work my way up the chain, and it really helps distinguish then men from the boys.
  1. How would you explain DNS to someone who wasn't technical? (Comparing it to a phone book is the best answer I've received).
  2. What's an A record? CNAME record?
  3. What's the difference between a forward lookup and a reverse lookup? What if one fails and not the other?
  4. Why would you use a FQDN vs. not?
  5. Why would you or would you not use ping or nslookup? The difference?
  6. What's the difference between "server1.example.com" and "server1.example.com." (note trailing period - 98% of candidates can't answer this correctly).
Anyway, back to the original question. OP, setup a basic DNS server with VirtualBox or something and start to play around with it. While not ideal, a Windows 2003/2008 box will be the easiest to start with. That will get you down the road of familiarizing yourself.
Click to expand...
Thank you for that... really. Those questions helped me a lot just by finding the answers to them using Google. You seem to know this subject matter more than most.
 
You must log in or register to reply here.
Back
Top