DNS Zones and Records

DNS Fundamentals

• A DNS record is a part of a zone that contains information about a domain.
• Types of DNS records:
  • A record: IPv4 host address record.
  • PTR record: pointer record (reverse of A).
  • SOA record: Start of Authority (contains data to control the zone transfer).
  • CNAME record: alias record.
  • NS record: name server record (contains name of authoritative name server in a DNS zone).
  • AAAA record: IPv6 host address record.
  • SRV record: service record, specifies host and port for specific services.

DNS Zone Types

• Primary zone: zone where all changes are made, has read/write copy of zone data, and located in c:\windows\system32\dns.
• Secondary zone: zone where primary replicates to, can't process updates from client computers, and has read-only copy of zone data.
• Stub zone: contains data of another zone for search purpose, used to find the right server containing the zone instead of searching every server for a specific zone.
• Active directory integrated zones: replicates DNS zone info using AD DS replication, every domain controller needs DNS enabled, and can only replicate from 1 integrated zone to another.

DNS Dynamic Updates

• None: records are manually added.
• Nonsecure and secure: clients can perform updates.
• Secure only: AD domain clients can perform updates.

DNS Name Resolution

• DNS Recursive query: a query sent to a local DNS server that requires a complete answer from the server (entire FQDN or entire IP address).
• DNS Iterative query: queries sent to different DNS servers to find the answer to the recursive query.

DNS Caching

• Temporarily stores info about previous DNS lookups and stores them on the DNS server.
• Located in c:\windows\system32\dns.

Active Directory Domain Service (AD DS)

• On-premise hosted directory that connects all computers to a local directory called domain.
• Centralizes and simplifies administration of users that are domain-joined.
• Domain: group of objects (users, ...) that share the same AD database.

Domain Controller

• Runs AD DS and holds a copy of the database.
• Replicates changes with other DC's.
• Used for authenticating users and determining access.
• Minimum of 2 DCs per domain for redundancy.

AD Database

• Stores all objects.
• 1 Domain controller is needed to create AD database.
• Objects have attributes (username, password, email, ...).
• 2 types of objects: containers and leaf.

AD DS Structure

• Trees: group of domains, 2-way trust between parent and child, child inherits from parent.
• Forest: group of AD trees, all domains in tree share same schema, Global Catalog.

DNSSEC

• Security for DNS zone.
• Zone and all records in it are asymmetric encrypted (public and private key).
• Public key is in Trust Point folder on DNS server.
• Not confidential for data.
• Assures clients that the DNS in use is a valid one and not a hacker.

DHCP

• Automatically gives an IP address, subnet mask, default gateway, domain name, and DNS server to end devices.
• Minimizes errors caused by static IP.
• Reduces network administration.
• Optional feature in Windows Server.
• UDP port: 67, 68.