Planning DNS Forwarding Requirements

Plan a host name resolution strategy.

• Plan a forwarding configuration.

Before a discussion of forwarding and slave DNS servers can be undertaken, some general knowledge of how DNS clients query a DNS server to resolve IP addresses is of some use.

In a TCP/IP network, a DNS resolver is any system that has been configured with one or more DNS server IP addresses and that performs queries against these DNS servers. The DNS resolver is part of the DNS Client service, which is automatically installed when Windows is installed. The resolver can request one of two types of queries from a DNS server: recursive or iterative.

A recursive query is a DNS query that is sent to a DNS server from a DNS resolver asking the DNS server to provide a complete answer to the query, or an error stating that it cannot provide the information. If the DNS server is also configured as a forwarder, the query can be forwarded directly to another DNS server. If the query is for a name outside the local DNS server's zone of authority, it performs an iterative query against a root DNS server, which then responds with the IP address of the DNS server whose zone of authority includes the desired IP top-level domain. Additional iterative queries are then performed until the name is resolved into its IP address or an error is produced.

An iterative query is a DNS query that is sent by a DNS server to another DNS server in an effort to perform name resolution. Consider the example of a workstation (DNS resolver) in the bigcorp.com domain that wants to communicate with a Web server located in the smallcorp.com domain . Figure 3.3 illustrates the process by which the IP address for www.smallcorp.com will be resolved to its IP address. Recall that www is a typical alias for a Web server or bank of clustered Web servers.

Figure 3.3. The initial recursive query results in several iterative queries in an effort to resolve the name to an IP address.

The process illustrated in Figure 3.3 follows these basic steps:

1. The DNS resolver (the local workstation) sends a recursive query to its local DNS server requesting the IP address of www.smallcorp.com .

2. The local DNS server, which is also configured as a forwarder, does not have information about www.smallcorp.com in its zone of authority and thus issues an iterative query to a root DNS server for the IP address of www.smallcorp.com .

3. The root DNS server does not have the requested information about the IP address of www.smallcorp.com , but it does know the IP address of a nameserver for the smallcorp.com zone . It provides this information back to the requesting DNS server.

4. The local DNS server next issues an iterative query to the DNS server for the smallcorp.com zone asking it for the IP address of www.smallcorp.com .

5. The smallcorp.com DNS server is authoritative for that zone, so it provides the requested IP address back to the local DNS server for www.smallcorp.com .

6. The local DNS server next passes the IP address of www.smallcorp.com back to the requesting workstation.

7. The client can now make a connection to www.smallcorp.com .

So, with the discussion of how DNS queries are performed and resolved under your belt, you can begin to plan for configuration and use of DNS forwarders on the network.

A DNS forwarder is a DNS server that accepts forwarded recursive lookups from another DNS server and then resolves the request for that DNS server. This capability can be useful if you do not have local copies of your internal DNS zone and want to have your local DNS server forward DNS queries to a central DNS server that is authoritative for your internal DNS zone. Caching-only servers make good DNS forwarders. If the DNS forwarder does not receive a valid resolution from the server that it forwards the request to, it attempts to resolve the client request itself.

A DNS slave server is a DNS forwarder server that does not try to resolve a resolution request if it doesn't receive a valid response to its forwarded DNS request. You typically see this type of DNS server implemented in conjunction with a secure Internet connection.

A new feature in Windows Server 2003, conditional forwarding , enables administrators to direct DNS requests to other DNS servers based on domain. Previous versions of Microsoft DNS supported only one forwarder, so if forwarding were enabled, all requests would be sent to a single server. This feature is used frequently when you want requests made to the internal network to be forwarded to a master DNS server that stores internal DNS zones, but have resolution requests that are made to Internet domains be sent to the Internet using the standard resolution process.

EXAM TIP

Know conditional forwarding Because enabling conditional forwarding is a new capability with Windows Server 2003's DNS service, you need to be familiar with how it works and when you might need to use it.

Figure 3.4 shows the Forwarders tab of the DNS server Properties dialog box.

Figure 3.4. On the Forwarders tab, you can configure where this server will send DNS requests if another DNS server will be supplying some or all of the DNS resolution for that server.

NOTE

Don't disable recursion If you disable recursion in the DNS server properties, you cannot use a forwarder. Forwarding DNS requests requires that the DNS server be capable of making recursive queries.

Say that you have a single internal domain called lab1.area51partners.com . You need to forward any queries to that domain directly to the primary DNS server for the lab1.area51partners.com domain. The Windows Server 2003 DNS service enables you to configure forwarding for a single domain, a group of domains, or all domains. Earlier versions of the Windows DNS service supported only forwarding of all domains; it was an all-or-nothing proposition. The functionality of being able to split forwarding among multiple servers while still resolving some domains locally is known as conditional forwarding . Figure 3.5 shows the different IP address that has been configured for conditional forwarding to the internal domain.

Figure 3.5. Conditional forwarding enables you to configure specific DNS servers by domain.

A common implementation of DNS forwarders in a Windows Server 2003 network has one specific DNS server being allowed to make queries to DNS servers outside the firewall. This implementation allows the firewall to be configured to allow DNS traffic only from this specific DNS server to leave the protected network, and allows only valid replies back to the DNS server to enter the protected network. Through this approach, all other DNS trafficboth inbound and outboundcan be dropped at the firewall, adding to the overall security of the network and the DNS service. Figure 3.6 illustrates this concept.

Figure 3.6. DNS forwarders can be implemented to control DNS traffic into and out of the protected network.

Forwarders can be used to ensure that DNS queries have the best possible chance of being answered with the requested information.

As you have seen, they also can be implemented to increase security of the DNS service on your network. With security in mind, we examine other ways you can configure additional security to your DNS servers.

GUIDED PRACTICE EXERCISE 3.1

In this exercise, you'll be planning and implementing a DNS forwarding solution.

• You have been hired as a network consultant for ACME Widgets, Incorporated.

• ACME has offices and manufacturing facilities located in the United States, Canada, Mexico, England, and France. All locations are connected via permanent VPN connections over the Internet.

• All resources for each country are located in a child domain under the acmewidgets.com domain. All zones are Active Directory integrated.

• Each child domain contains two DNS servers that are responsible for the DNS information for resources in that child domain's zone file. The DNS server IP addresses are 172.16.10.56 and 172.16.10.57 (United States), 172.16.12.56 and 172.16.12.57 (Canada), 172.16.13.56 and 172.16.13.57 (Mexico), 172.16.15.56 and 172.16.15.57 (England), and 172.17.15.56 (France).

• You have two external DNS servers at each location that are maintained by the local ISP providing the Internet connection.

• You need to provide a DNS forwarding solution that provides the best overall resolution speeds for all Internal and External name queries. You are configuring the DNS servers in the United States first.

You should try doing this on your own first. If you get stuck, or you would like to see one possible solution, follow these steps:

1. Open the DNS console.

2. Right-click the first DNS server in the United States (172.16.10.56) and select Properties from the context menu.

3. Select the Forwarders tab in the Server Properties dialog box.

4. Enter the DNS domain ca.acmerockets.com using the New button on the Forwarders tab.

5. Enter the IP addresses of the Canada DNS servers (172.16.12.56 and 172.16.12.57) to this entry using the Add button on the Forwarders tab.

6. Enter the DNS domain mx.acmerockets.com using the New button on the Forwarders tab.

7. Enter the IP addresses of the Mexico DNS server (172.16.13.57) to this entry using the Add button on the Forwarders tab.

8. Enter the DNS domain uk.acmerockets.com using the New button on the Forwarders tab.

9. Enter the IP addresses of the England DNS servers (172.16.15.56 and 172.16.15.57) to this entry using the Add button on the Forwarders tab.

10. Enter the DNS domain fr.acmerockets.com using the New button on the Forwarders tab.

11. Enter the IP addresses of the France DNS server (172.17.15.56) to this entry using the Add button on the Forwarders tab.

12. Select the All Other DNS Domains entry.

13. Enter the IP addresses of the United States public DNS servers for this entry. This will direct all DNS queries that do not match any of your internal domains to be forwarded to your external DNS servers.

14. Close the Server Properties dialog box.