- The DNS Namespace
- Planning DNS Zone Requirements
- Planning DNS Forwarding Requirements
- Configuring DNS Security
- Integrating with Third-Party DNS Solutions
- Exam Prep Questions
- Need to Know More?
This chapter is from the book
This chapter is from the book
This chapter is from the book
Planning DNS Forwarding Requirements
Before a discussion of forwarding and slave DNS servers can be undertaken, some general knowledge of how DNS clients query a DNS server to resolve IP addresses is of some use.
In a TCP/IP network, a DNS resolver is any system that has been configured with one or more DNS server IP addresses and that performs queries against these DNS servers. The DNS resolver is part of the DNS Client service, which is automatically installed when Windows is installed. The resolver can request one of two types of queries from a DNS server: recursive or iterative.
A recursive query is a DNS query that is sent to a DNS server from a DNS resolver asking the DNS server to provide a complete answer to the query, or an error stating that it cannot provide the information. If the DNS server is also configured as a forwarder, the query can be forwarded directly to another DNS server. If the query is for a name outside of the local DNS server's zone of authority, it performs an iterative query against a root DNS server, which then responds with the IP address of the DNS server whose zone of authority includes the desired IP top-level domain. Additional iterative queries are then performed until the name is resolved into its IP address or an error is produced.
An iterative query is a DNS query that is sent by a DNS server to another DNS server in an effort to perform name resolution. Consider the example of a workstation (DNS resolver) in the bigcorp.com domain that wants to communicate with a Web server located in the smallcorp.com domain. Figure 3.3 illustrates the process by which the IP address for http://www.smallcorp.com will be resolved to its IP address. Recall that www is a typical alias for a Web server or bank of clustered Web servers.
)
Figure
3.3 The initial recursive query results in several iterative queries in an
effort to resolve the name to an IP address.
The DNS resolver (the local workstation) sends a recursive query to its local DNS server requesting the IP address of http://www.smallcorp.com.
The local DNS server, which is also configured as a forwarder, does not have information about http://www.smallcorp.net in its zone of authority and thus issues an iterative query to a root DNS server for the IP address of http://www.smallcorp.com.
The root DNS server does not have the requested information about the IP address of http://www.smallcorp.com, but it does know the IP address of a nameserver for the smallcorp.com zone. It provides this information back to the requesting DNS server.
The local DNS server next issues an iterative query to the DNS server for the smallcorp.net zone asking it for the IP address of http://www.smallcorp.com.
The smallcorp.net DNS server is authoritative for that zone, so it provides the requested IP address back to the local DNS server for http://www.smallcorp.com.
The local DNS server next passes the IP address of http://www.smallcorp.com back to the requesting workstation.
The client can now make a connection to http://www.smallcorp.com.
So, with the discussion of how DNS queries are performed and resolved under your belt, you can begin to plan for configuration and usage of DNS forwarders on the network.
A DNS forwarder is a DNS server that accepts forwarded recursive lookups from another DNS server and then resolves the request for that DNS server. This can be useful if you do not have local copies of your internal DNS zone and want to have your local DNS server forward DNS queries to a central DNS server that is authoritative for your internal DNS zone. Caching-only servers make good DNS forwarders. If the DNS forwarder does not receive a valid resolution from the server that it forwards the request to, it attempts to resolve the client request itself.
A DNS slave server is a DNS forwarder server that will not try to resolve a resolution request if it doesn't receive a valid response to its forwarded DNS request. You will typically see this type of DNS server implemented in conjunction with a secure Internet connection.
A new feature in Windows Server 2003, conditional forwarding, enables administrators to direct DNS requests to other DNS servers based on domain. Previous versions of Microsoft DNS supported only one forwarder, so if forwarding were enabled, all requests would be sent to a single server. This is used frequently when you want requests made to the internal network to be forwarded to a master DNS server that stores internal DNS zones, but have resolution requests that are made to Internet domains be sent to the Internet using the standard resolution process.
TIP
Because enabling conditional forwarding is a new capability with Windows Server 2003's DNS service, you need to be familiar with how this works and when you might need to use it.
Figure 3.4 shows the Forwarders tab of the DNS server Properties dialog box.
Let's say that you have a single internal domain called lab1.area51partners.com. You need to forward any queries to that domain directly to the primary DNS server for the lab1.area51partners.com domain. The Windows Server 2003 DNS service enables you to configure forwarding for a single domain, a group of domains, or all domains. Earlier versions of the Windows DNS service supported only forwarding of all domains—it was an all-or-nothing proposition. The functionality of being able to split forwarding among multiple servers while still resolving some domains locally is known as conditional forwarding. Figure 3.5 shows the IP address that has been configured for conditional forwarding to the internal domain.
)
Figure
3.4 The Forwarders tab is used configure where this server will send DNS requests
if another DNS server will be supplying some or all of the DNS resolution for
that server.
)
Figure
3.5 Conditional forwarding enables you to configure specific DNS
servers by domain.
NOTE
If you disable recursion in the DNS server properties, you will not be able to use a forwarder. Forwarding DNS requests requires that the DNS server be capable of making recursive queries.
A common implementation of DNS forwarders in a Windows Server 2003 network has one specific DNS server being allowed to make queries to DNS servers outside of the firewall. This allows the firewall to be configured to allow DNS traffic only from this specific DNS server to leave the protected network, and allows only valid replies back to the DNS server to enter the protected network. Through this approach, all other DNS traffic—both inbound and outbound—can be dropped at the firewall, adding to the overall security of the network and the DNS service. Figure 3.6 illustrates this concept.
)
Figure
3.6 DNS forwarders can be implemented to control DNS traffic into and out
of the protected network.
Forwarders can be used to ensure that DNS queries have the best possible chance of being answered with the requested information. As you have seen, they also can be implemented to increase security of the DNS service on your network. With security in mind, we examine other ways you can configure additional security on your DNS servers.