Winteacher.com DNS Language:Farsi

DNS Domain Name Service (Farsi User Guide)

Winteacher.com

Resource: Windows 2000 Server Resource kit TCP/IP Core Networking Guide

2003-2005

Winteacher.com > Part2 > DNS > DNS Master Page

قبل از هرچيز بايد با مراحل Name Resolution يك Client آشنا شد تا بعد

ازآن موقعيت يك DNS Server در شبكه بيشتر براي شما مشخص شود
اين مراحل به ترتيب زير مي باشد يعني يك Host در شبكه براي بدست آوردن يك IP و به دنبال
آن بدست آوردن MAC Address آن سيستم بدين گونه عمل مي كند

Name Resolution

  • Local Host name

  • Host File

  • DNS

  • Wins

  • Broadcast

  • LMhost File
در شكل بالا ديديد كه DNS سومين راه براي يك HOST مي باشد از بين شش راه براي بدست آوردن IP يك Host

وظيفه اين سرويس در شبكه تبديل كردن FQDN به IP مي باشد يا در واقع تبديل نام يك Host به IP

در شكل زير مشاهده مي كنيد كه يك سرور DNS در برخورد با يك Request از يك Dns Client چگونه عمل مي كند

FQDN : fully qualified domain name

Example : S-NET.StandardEditions.NET.

Example : Host-a.example.microsoft.com.

اين سرويس بگونه ديگر نيز مي تواند عمل كند يعني تبديل IP به FQDN كه برعكس عمل در شكل بالا مي شود
اين كه يك سرور DNS چگونه عمل مي كند در جواب به چند عامل بستگي دارد
هر Request از طرف يك Dns Client داراي موارد زير مي باشد و يك DNS Server بايد اين موارد را جواب بدهد البته جواب سرور بستگي به شرايطي نيز دارد
  • A specified DNS domain name, stated as a fully qualified domain name (FQDN)
  • A specified query type, which can either specify a resource record by type or a specialized type of query operation
  • A specified class for the DNS domain name. For Windows DNS servers, this should always be specified as the Internet (IN) class.
DNS query process

The local resolver

در بالا شما مراحل DNS query را در يك شبكه مشاهده مي كنيد اول سيستم در Host fileخود به دنبال نام وIP مي گردد اگر جواب گرفت در همان مرحله جستجو

به پايان مي رسد در غيره اين صورت همانند بالا به دنبال يك DNS Server ميگردد و در Zone هاي آن سرور جستجو مي كند و بعد به Cache
موجود در سرور DNS مي رود و اگر باز جواب نگرفت به دنبال سرورهاي ديگر DNS مي رود
Caching and Time to Live
سرور DNS بعد از جواب دادن به هر query آن را در Cache خود نگهداري مي كند تا زمان مشخصي كه همان TTL يك ركورد درون Cache
گفته مي شود
براي بالا بردن سرعت Name resolution از اين روش استفاده مي كند تا از اين به بعد براي دادن جواب به Client ها از Cache استفاده كند
از دستور IPconfig /displaydns مي توان براي ديدن اطلاعات كامل cache يك DNS server استفاده كرد
براي پاك كردن يك Cache مي توان از دستور IPconfig /flushdns استفاده كرد
Querying a DNS server
اما يك DNS CLIENT براي رسيدن به IP يك FQDN چه مراحلي را سپري مي كند در شكل زير شما يك مثال براي FQDN=Example.microsoft.com
را مشاهده مي كنيد در اينجا Dns client براي رسيدن به سيستم Example بايد از سه DNS SERVER عبور كند تا به IP اين Host دسترسي داشته باشد
به Query ميان Zone هاي سرورهاي DNS كه از مرحله 2به بعد ديده مي شود Interactive queries گفته مي شود و به Query ميان سرور
DNS و Client ديده مي شود Recursive Queries گفته مي شود

ROOT DNS "."

در FQDN هر سيستمي در آخر نام آن يك "." وجود دارد در شكل بالا .Example.microsoft.com نيز همين گونه مي باشد پس ROOT DNS هميشه
در يك شبكه بايد وجود داشته باشد شما بعد از نصب يك DNS به صورت Automatic آن سرويس در خود يك Zone Root ايجاد مي كند
Zone در هر سرور DNS نمايان كنند قسمتي از يك FQDN مي باشد
در شكل بالا زماني كه DNS Client به سرور DNS خود رجوع مي كند اين سرور به دنبال FQDN مورد نظر در خود به صورت Locally مي گردد اگر اين نام را
پيدا نكرد به سرورهاي DNS ديگر كه برايش معرفي شده مي رود تا اين Request را كه از طرف client خود آمده را جواب دهد
زماني كه اين Request از سرور DNS به Root DNS مي رسد سرور در جواب به آن آدرس سرور DNS COM را مي دهد تا Request به

آنجا فرستاده شود وقتي Request به سرور DNS COM رسيد آن در جواب آدرس سرور DNS MICROSOFT را مي دهد و در آخر

Packet به سرور DNS مي رسد كه ادرس HOST=Example.microsoft.com درآن وجود دارد و در مرحله آخر .FQDN:Example.microsoft.com
به DNS CLIENT برگردانده مي شود البته IP Address آن منظور مي باشد
در شكل زير شما مي توانيد كاملا نقش ROOT SERVER را مشاهده كنيد در Internet

FQDN : www.microsoft.com.

FQDN : host-a.example.microsoft.com.

WINS LOOKUP AND Querying a DNS server
اما از Wins مي توان در Name Resolution استفاده كرد در شكل زير مي بينيد كه سرور DNS با سرور Wins رابطه برقرار كرده است در واقع DNS از
سرور Wins براي جواب به DNS Client كمك گرفته
  • The DNS server separates the host part of the name (host-a) from the fully qualified domain name contained in the DNS query. The host part of the name is the first label in the queried DNS domain name before a period is used in the name.
  • The server then sends a NetBIOS name request to the WINS server using the host name, host-a.
  • If the WINS server can resolve the name, it returns the IP address to the DNS server.
  • The DNS server then compiles an A resource record using the IP address resolved through the WINS server and returns this record to the original preferred DNS server that was queried by the requesting client, host-b.
  • The preferred DNS server then passes the query answer back to the requesting client.
لازم بذكر مي باشد اگر FQDN در خواست شده در هيچ كدام يك از DNS بالا نباشد سرور DNS آخر يك NETBIOS NAME را از
سرور Wins در خواست مي كند اگر در Database سرور Wins اين ركورد وجود داشته باشد اين ركورد توسط DNS آخر در يافت مي شود
و به DNS Client داده مي شود در واقع IP Address موجود در ركورد را DNS گرفته و تبديل يه يك ركورد از نوع DNS مي كند و به DNS Client
برمي گرداند

Securing DNS deployment

When designing your DNS server deployment, use the following DNS security guidelines:

  • If your network hosts are not required to resolve names on the Internet, eliminate DNS communication with the Internet. In this DNS design, you can use a private DNS namespace that is hosted entirely in your network. The private DNS namespace is distributed just as the Internet DNS namespace, with your internal DNS servers hosting zones for the root domain and top-level domains.
  • Split the DNS namespace for your organization between internal DNS servers behind the firewall and external DNS servers in front of the firewall. In this DNS design, your internal DNS namespace is a subdomain of your external DNS namespace. For example, if the Internet DNS namespace for your organization is adatum.com, then the internal DNS namespace for your network is corp.adatum.com.
  • Host your internal DNS namespace on internal DNS servers and host your external DNS namespace on external DNS servers exposed to the Internet. To resolves queries for external names made by internal hosts, the internal DNS servers forward queries for external names to the external DNS servers. External hosts use only the external DNS servers for Internet name resolution.
  • Configure your packet-filtering firewall to only allow UDP and TCP port 53 communication between your external DNS server and a single internal DNS server. This will facilitate communication between internal and external DNS servers and prevent any other external computer from gaining access to your internal DNS namespace.
در DNS مواردي را كه در بالا گفته شده براي امنيت شبكه لازم مي باشد كه توجه شود
************************************************
اولين مورد در شبكه دو نوع query بنام Public ,Private وجود دارد اگر شما ارتباطي با Internet نداشته باشيد Public query وجود ندارد
در نتيجه بهترين كار اين مي باشد كه در قسمت Root Domain نام سرورهاي Private Network را فقط اضافه كنيد در واقع ارتباطي با سرور هاي DNS در
Internet نداشته باشيد
دوم جدا كردن سرورهاي DNS در Private Network از شبكه Internet توسط يك Firewall البته امكان دارد در اين حالت شما Subdomain يكي
از Internet Domain باشيد به عنوان مثال يك Domain با نام adatum.com اگر سرور Host-1 شما يكي از DNS هاي شبكه باشد در Internet اين
سرور را بانام Host-1.adatum.com مي توان شناسايي كرد البته وجود Firewall لازم مي باشد براي امنيت LAN شما
در سومين حالت ميان Private Network شما با Internet يك ارتباط يك طرفه وجود دارد بدين صورت كه شبكه شما مي توانند Public query داشته باشد
يعني سرور هاي DNS شما هر query را كه نتوانند جواب دهند را به Internet ارسال مي كنند تا يك سرور DNS موجود در Internet به آن جواب دهد در اين
حالت افراد درون Internet نمي توانند query خود را به LAN شما ارسال كنند
در حالت چهارم بهترين كار براي داشتن امنيت بالا و نيز امكان ارتباط با سرور هاي DNS در Internet استفاده از Filtering در Firewall مي باشد براي
بالا بردن امنيت يك Firewall مي توان كليه Port هاي سيستم را بست و فقط Port هاي مورد نياز مانند Port : 80 , 53 را باز نگه داريد

DNS security threats

The following are the typical ways in which your DNS infrastructure can be threatened by attackers:

  • Footprinting is the process by which DNS zone data is obtained by an attacker to provide the attacker with the DNS domain names, computer names, and IP addresses for sensitive network resources. An attacker commonly begins an attack by using this DNS data to diagram, or footprint, a network. DNS domain and computer names usually indicate the function or location of a domain or computer in order to help users remember and identify domains and computers more easily. An attacker takes advantage of the same DNS principle to learn the function or location of domains and computers in the network.
امكان دارد يك فرد يا افرادي با بدست آوردن يك سري اطلاعات در مورد يك Zone در داخل شبكه شما با درست كردن يك نام و IP Address براي خود به شبكه
شما به صورت Remote وارد شوند هكرها مي توانند با در دست داشتن اين اطلاعات خيلي كم وارد شبكه شما شوند البته اين كار از روشهاي معمولي حمله به يك
شبكه مي باشد در نتيجه دانستن آن مهم مي باشد زماني كه اين افراد بتوانند از طريق سرويس DNS و از طريق اطلاعات يك Zone خود را در شبكه قانوني جلوه
دهدند مي توانند به كليه Resource هاي شبكه بعد از مدت زمان كوتاهي دسترسي پيدا كنند اين افراد با قوانين DNS كاملا آشنا مي باشند
  • Denial-of-service attack is when an attacker attempts to deny the availability of network services by flooding one or more DNS servers in the network with recursive queries. As a DNS server is flooded with queries, its CPU usage will eventually reach its maximum and the DNS Server service will become unavailable. Without a fully operating DNS server on the network, network services that use DNS will become unavailable to network users.
يكي ديگر مواردي كه يك سرور DNS را مي تواند از كار بي اندازد حمله بيش از حد در يك لحظه به سرور از طريق QUERY مي باشد
اين عمل باعث مي شود سرويس DNS از كار بي افتد اين اتفاق را ممكن است هكرها تدارك ببينند يا يك ويروس يا يك مشكل در سيستم عامل
  • Data modification is an attempt by an attacker (that has footprinted a network using DNS) to use valid IP addresses in IP packets the attacker has created, thereby giving these packets the appearance of coming from a valid IP address in the network. This is commonly called IP spoofing. With a valid IP address (an IP address within the IP address range of a subnet), the attacker can gain access to the network and destroy data or conduct other attacks.

يكي از معروفترين حمله هاي Internet توسط هكرها IP spoofing نام دارد در اين حمله فرد بعد شناسايي يا پيدا كردن IP Address شما يك Packet براي
شما ارسال مي كند معمولا اين Packet ارسال شده غيره منتظره مي باشد و شما را وادار به جواب مي كند مي تواند اين اتفاق يك Message باشد شما بعد ديدن اين
پيغام يا Spam و جواب دادن به آن يك سري Port سيستم را براي آن فرد باز كرده ايد تا از طريق آنها به سيستم شما حمله كند اين حمله مي تواند بدتر از اين

هم باشد به طوري كه كليه Packet هاي ارسالي به سيستم شما يك نسخه براي هكر هم ارسال مي شود و از اين نوع موارد ... لازم بذكر مي باشد Firewall

و Router ها نمي توانند از اين نوع حمله به شما جلوگيري كنند چون سيستم شما آلوده شده بهترين راه جلوگيري استفاده از Anti Virus مي باشد

  • Redirection is when an attacker is able to redirect queries for DNS names to servers under the control of the attacker. One method of redirection involves the attempt to pollute the DNS cache of a DNS server with erroneous DNS data that may direct future queries to servers under the control of the attacker. For example, if a query were originally made for example.microsoft.com and a referral answer provided a record for a name outside of the microsoft.com domain, such as malicious-user.com, then the DNS server would use the cached data for malicious-user.com to resolve a query for that name. Redirection can be accomplished whenever an attacker has writable access to DNS data, such as with insecure dynamic updates.

يك روش براي از بين بردن كارايي يك DNS Server آلوده كردن Cache موجود در DNS مي باشد براي مثال يك query را مي توان در زمان جواب دادن
آدرس نادرست داد براي اين كار بايد cache يك سرور DNS را دستكاري كرد

Three levels of DNS security

The following three levels of DNS security will help you understand your current DNS configuration and enable you to increase the DNS security of your organization.
سه حالت زير براي امنيت يك سرور DNS مي تواند وجود داشته باشد

Low-level security

Low-level security is a standard DNS deployment without any security precautions configured. Only deploy this level of DNS security in network environments where there is no concern for the integrity of your DNS data or in a private network where there is no threat of external connectivity.

  • The DNS infrastructure of your organization is fully exposed to the Internet.
  • Standard DNS resolution is performed by all DNS servers in your network.
  • All DNS servers are configured with root hints pointing to the root servers for the Internet.
  • All DNS servers permit zone transfers to any server.
  • All DNS servers are configured to listen on all of their IP addresses.
  • Cache pollution prevention is disabled on all DNS servers.
  • Dynamic update is allowed for all DNS zones.
  • User Datagram Protocol (UDP) and Transmission Control Protocol/Internet Protocol (TCP/IP) port 53 is open on the firewall for your network for both source and destination addresses.
در حالت اول كه حالت Low-level مي باشد سرور DNS داراي اين تنظيمات مي باشد

Medium-level security

Medium-level security uses the DNS security features available without running DNS servers on domain controllers and storing DNS zones in Active Directory.

  • The DNS infrastructure of your organization has limited exposure to the Internet.
  • All DNS servers are configured to use forwarders to point to a specific list of internal DNS servers when they cannot resolve names locally.
  • All DNS servers limit zone transfers to servers listed in the name server (NS) resource records in their zones.
  • DNS servers are configured to listen on specified IP addresses.
  • Cache pollution prevention is enabled on all DNS servers.
  • Dynamic update is not allowed for any DNS zones.
  • Internal DNS servers communicate with external DNS servers through the firewall with a limited list of source and destination addresses allowed.
  • External DNS servers in front of your firewall are configured with root hints pointing to the root servers for the Internet.
  • All Internet name resolution is performed using proxy servers and gateways.

حالت دوم Medium-level حالتي با امنيت تقريبا بالا و مناسب البته حالت دوم در مواردي مي باشد كه DNS بر روي ADS وجود ندارد و
اطلاعات Zone هاي سرور DNS بر روي ADS ذخيره نشده باشد

High-level security

High-level security uses the same configuration as medium-level security and also uses the security features available when the DNS Server service is running on a domain controller and DNS zones are stored in Active Directory. In addition, high-level security completely eliminates DNS communication with the Internet. This is not a typical configuration, but it is recommended whenever Internet connectivity is not required.

  • The DNS infrastructure of your organization has no Internet communication by internal DNS servers.
  • Your network uses an internal DNS root and namespace, where all authority for DNS zones is internal.
  • DNS servers that are configured with forwarders use internal DNS server IP addresses only.
  • All DNS servers limit zone transfers to specified IP addresses.
  • DNS servers are configured to listen on specified IP addresses.
  • Cache pollution prevention is enabled on all DNS servers.
  • Internal DNS servers are configured with root hints pointing to the internal DNS servers hosting the root zone for your internal namespace.
  • All DNS servers are running on domain controllers. A discretionary access control list (DACL) is configured on the DNS Server service to only allow specific individuals to perform administrative tasks on the DNS server.
  • All DNS zones are stored in Active Directory. A DACL is configured to only allow specific individuals to create, delete, or modify DNS zones.
  • DACLs are configured on DNS resource records to only allow specific individuals to create, delete, or modify DNS data.
  • Secure dynamic update is configured for DNS zones, except the top-level and root zones, which do not allow dynamic updates at all.

در حالت High-level شما اطلاعات DNS را بروي يك DC و در يك ADS ذخيره كرده ايد كه داراي امنيت بالاتري مي باشد

در DNS چند نوع ركورد وجود دارد در زير مي توانيد شرح كامل آنها را مشاهده كنيد

DNS Records

Resource records reference

Start of Authority (SOA) Resource Records

در اين ركورد يك سري اطلاعات مورد نظر يك سرور وجود دارد كه در زير مشخصات آنها را مشاهده مي كنيد

Owner, TTL, Class, and Type fields

در اين قسمت كليه پيكر بندي يك ركورد مشخص شده از جمله سازنده و نوع و زمان زيستن يك ركورد در DataBase و..
authoritative server field
نشان دهنده سرور Primary DNS يك ركورد
responsible person field
نمايان كننده آدرس Mail فرد Admin يك Zone مي باشد
serial number field
در اين قسمت يك عدد وجود دارد كه نشان دهنده يك آخرين زمان Update شدن يك Zone را نشان مي دهد رماني كه Secondary DNS با
سرور Primary DNS ارتباط برقرار مي كند به عدد حساس مي باشد و از اين طريق مي فهمد كه Zone تغييري كرده يا خير در واقع آن را با
Serial خود چك مي كند
refresh field
در اين قسمت تعداد مراجعت Secondary DNS به يك Zone را نمايش مي دهد كه براي Check كردن Update شدن يك Zone رخ مي دهد
retry field
در اين قسمت تعداد درخواست Transferيك Secondary DNS را براي يك Zone را نمايش مي دهد
expire field
تعداد دفعاتي كه Transfer بين Scondary DNS و يك Zone ناتمام مانده و يا Error داشته
minimum TTL field
زماني كه يك ركود TTL آن مشخص نباشد اين زمان تعريف شده به آن داده مي شود كه وقتي Client آن را درخواست كرد چود مدت زمان TTL
ندارد اين زمان را به آن بدهد تا مشكلي رخ ندهد
The following example shows the SOA resource record:

noam.reskit.com. IN SOA (

noamdc1.noam.reskit.com. ; authoritative server

for the zone

administrator.noam.reskit.com. ; zone admin e-mail

; (responsible person)

5099 ; serial number

3600 ; refresh (1 hour)

600 ; retry (10 mins)

86400 ; expire (1 day)

60 ) ; minimum TTL (1 min)

Name Server (NS) Resource Records

براي مشخص شدن Primary ,Secondary DNS سرور هر Zone بايد حداقل يك NS record در Zone Root وجود داشته باشد
براي مشخص شدن Delegated Zone و نيز SOA record هر سرور نيز به اين ركورد نياز مي باشد
درزماني كه Admin درreskit.com يك Delegate Authority ايجادكندبرايnoam.reskit.com subdomain to noamdc1.noam.reskit.com
ركورد زير در هر دو Zone مورد نظر ايجاد مي شود

noam.reskit.com. IN NS noamdc1.noam.reskit.com
Delegation and Glue Records
اين ركورد تركيبي ار NS record وA record مي باشد كه در زير مشاهده مي كنيد در واقع دو ركورد مي باشد
زماني كه در سرور DNS در Zone با نام reskit.com مربوط به سرور noam.reskit.com به سرور noamNS.reskit.com
عمل Delegate Authority را انجام مي دهيد ركوردهاي زير ساخته مي شود
noam.reskit.com. IN NS noamNS.noam.reskit.com

noamNS.noam.reskit.com. IN A 172.16.54.1

در شکل زیر Property یک Zone را مشاهده می کنید که برخی از Tab های مهم آن شرح داده خواهد شد . برای تغییر دادن پیکربندی یک Zone باید

مراحل زیر را انجام دهید

To modify Property for a directory-integrated zone.(Forward Lookup Zones)

  1. Open DNS.
  2. In the console tree, click the applicable zone.

    Where?

    • DNS
    • applicable DNS server
    • Forward Lookup Zones (or Reverse Lookup Zones)
    • applicable zone
  3. On the Action menu, click Properties.

Properties For Zone

General Tab
WINS Tab

Name servers Tab

Security Tab

Zone Transfers Tab
Change Type Zone

در شکل زیر Property یک DNS Serv را مشاهده می کنید که برخی از Tab های مهم آن شرح داده خواهد شد . برای تغییر دادن پیکربندی یک Server

باید مراحل زیر را انجام دهید

To configure a DNS server to use (InterfacesTab forwardersTab AdvancedTab Root HintsTab ..)

  1. Open DNS.
  2. In the console tree, click the applicable DNS server.

    Where?

    • DNS
    • applicable DNS server
  3. On the Action menu, click Properties.

Properties For DNS Server

Interfaces Tab

Security Tab

Root Hint Tab
Advanced Tab
Forwarders Tab

To modify Property for a directory-integrated zone.(Reverse Lookup Zones)

  1. Open DNS.
  2. In the console tree, click the applicable zone.

    Where?

    • DNS
    • applicable DNS server
    • Forward Lookup Zones (or Reverse Lookup Zones)
    • applicable zone
  3. On the Action menu, click Properties.
Properties For Zone

General Tab

WINS-R Tab
Name servers Tab
Security Tab

Zone Transfers Tab

Change Type Zone

Related Topics

  • Naming Hosts and Domains

  • Windows 2000 Resolver

  • Setting Up DNS for Active Directory

  • Active Directory Integration and Multimaster Replication

  • Dynamic Update and Secure Dynamic Update

  • Aging and Scavenging of Stale Records

  • Integration with WINS

  • Interoperability with Other DNS Servers

  • Internet Access Considerations

  • Troubleshooting

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

Winteacher.com > Part2 > DNS > DNS Master Page


Winteacher.com DNS Naming Hosts and Domains language:Farsi

2003-2005

> Part2 > DNS > Naming Hosts and Domains

fully qualified domain name (FQDN)

در سيستم هاي Prewin2000 براي بدست آوردن نام يك سيستم و شناسايي آن از NetBIOS name استفاده مي شد اما در Win 2000 به بعد از FQDN
استفاده مي شود
در واقع يك FQDN نام كامل يك Host در شبكه نمي باشد با اضافه شدن Primary DNS Suffix نام كامل يك سيستم را در شبكه هاي WIN2K بوجود مي آيد
primary DNS suffix
در حالت عادي سيستم بعد از Joined شدن به يك ADS نامش كامل مي شود يا در واقع مشخص تر مي شود

در شكل بالا يك HOST داراي دو Interface مي باشد كه يكي Private و د.ومي Public مي باشد اين سيستم داراي دو FQDN در دو شبكه مجزا مي باشد
در Internet داراي FQDN=Client1.isp01-ext.com مي باشد و در LAN داراي FQDN=Client.reskit.com مي باشد

FQDN = Client1.Reskit.com

FQDN = Host name . DNS suffix

براي معرفي كردن يك DNS Suffix مي توان در آدرس زير در سيستم اين مورد را اعمال كرد
  1. Right-click My Network Places, and then click Properties.
  2. Right-click the connection that you want to view, and then click Properties.
  3. Click Internet Protocol (TCP/IP), and then click Properties.
  4. Click Advanced, and then click the DNS tab.

Use this connection's DNS suffix in DNS registration

زماني كه يك Interface داراي يك DNS Suffix شد با اين گزينه به سيستم مي گوييم كه اين HOST را در Zone موجود در DNS ثبت كند

تذكر بايد دقيقا نام DNS Suffix با نام Zone موجود در DNS يكسان باشد

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Naming Hosts and Domains


Winteacher.com DNS Windows 2000 Resolver Language:Farsi

2003-2005

> Part2 > DNS > Windows 2000 Resolver

caching resolver service
اين سرويس در Win2000 وجود دارد و وظيفه اش كاستن از ترافيك DNS مي باشد و سرعت دادن به كار Name Resolution مي باشد
براي اين كار اين سرويس يك Cache از DNS در خود سيستم بوجود مي آورد براي رفع مشكلات اين سرويس مي توان آن را ديد و Start و يا Stop كرد
البته بطور خودكار بعد از Boot شدن سيستم Start مي شود اين سرويس را در قسمت Component Service مي توان ديد و Manage كرد
اين سرويس كارهاي زير را براي يك HOST در صورت لزوم انجام مي دهد
  • Name resolution.
  • General caching of queries.
  • Negative caching.
  • Keeps track of transient (Plug and Play) network adapters and their IP configurations.
  • Keeps track of connection-specific domain names.
  • When a server fails to respond to a query, the resolver ceases to query that server for a certain amount of time.
  • When the resolver receives multiple A resource records from a DNS server, it prioritizes them based on their IP address.

Name resolution

در WIN NT4 براي Name resolution اول از NetBIOS Name استفاده مي شود بعد ازآن از DNS استفاده مي شود ولي در WIN 2000

اول از DNS استفاده مي شود بعد از NetBIOS Name
در WIN 2000 اول سيستم توسط يكي از توابع API خود query را به DNS مي فرستد اگر جواب نگرفت يا به دليلي DNS جواب نداد query را چك مي كند
كه Name بيشتر از 15Byte نباشد اگر اين شرط نيز رعايت شده بود سپس سيستم به به سرويس NetBIOS روي مي آورد
Configuring Subnet Prioritization
در زماني كه يك FQDN با چند IP Address در شبكه وجود داشته باشد مي توان براي بالا بردن سرعت Name Resolution از گزينه Round Robin
در DNS استفاده كرد به عنوان مثال www.reskit.com داراي سه سرور جداگانه در شبكه مي باشد در واقع براي وصل شدن به اين سايت سه سرور آماده جواب
دادن به Request هاي Client ها مي باشد

www.reskit.com. IN A 172.16.64.11

www.reskit.com. IN A 172.17.64.22

www.reskit.com. IN A 172.18.64.33
Round robin اين امكان را مي دهد كه Request ها به صورت دوره اي به اين سه سرور ارسال شود تا از حمله كليه Request ها به يك سرور جلوگيري كند
اين عمل در سايت هاي تجاري كه داراي ترافيك بالاي حمله Request هاي كاربران مي باشد بسيار مفيد مي باشد در واقع اولين Request به سرور اول مي رود
و كاربر بعدي ديگر Request خود را به سرور اولي ارسال نمي كند و به سرور دومي ارسال مي كند و الي آخر به همين ترتيب
در آدرس Registry زير مي توان Round robin را تنظيم كرد بر روي Client بايد يك Value بنام PrioritizeRecordData از نوع REG_DWORD

را برابر صفر قرار دهيد

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DnsCache\Parameters

Configuring Subnet Prioritization on the Server

بر روي سرور بايد يگ Value بنام LocalNetPriority از نوع REG_DWORD برابر با يك ايجاد كرد البته درون

سرويس DNS در قسمت Server-Properties در Advanced-Tab مي توان Round robin را فعال كرد و نيازي به Registry نمي باشد

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters

Preventing the Resolver from Accepting Responses from Non-Queried Servers

در حالت Default يك Resolver جواب را از سروري كه به آن query ارسال نكرده نيزدريافت مي كند اين عمل Security يك سيستم را بخطر
مي اندازد اما به اين دليل پيش فرض مي باشد كه سرعت عمل Name Resolution را بالا مي برد مي توان اين پيش فرض را Disable كرد براي اين كار در
Registry سيستم بايد يك Value بنام QueryIpMatching از نوع REG_DWORD را برابربا يك قرارداد
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DnsCache\Parameters

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Windows 2000 Resolver


Winteacher.com DNS Setting Up DNS for Active Directory Language:Farsi

2003-2005

> Part2 > DNS > Setting Up DNS for Active Directory

ADS براي راه اندازي به يك DNS سرور نياز دارد براي شناسايي Zone كه در آن بايد خود را در آن Register كند كليه مشخصات DNS ازجمله FQDN و
Zone ها و نيز Trust ها و Replicate ها از اين به بعد به عنوان بك Object درون ADS Database نگهداري مي شود و از طريق آن رهبري مي شود
بهترين راه براي جلوگيري از Error بهتر است در زمان نصب ADS سرويس DNS را نيز نصب كنيد امكان دارد شما از قبل سرويس DNS در شبكه داشته باشيد
و در زمان نصب ADS سيستم به دنبال يك DNS سرور مي گردد كه معتبر از نظر DC باشد اگر سرور DNS در حالت Dynamic Update به DC جواب مثبت
داد ديگر بر روي DC به صورت Locally سرويس DNS نصب نمي شود در غيره اين صورت بر روي سرور DC سرويس DNS نيز نصب مي شود
در زمان نصب يك Active directory سيستم از روي پيكر بندي TCP/IP سيستم به دنبال DNS سرور معرفي شده به سيستم مي گردد و يك query به آن
مي فرستد كه ببيند آيا آن سرور Root DNS مي باشد يا خير اگر جواب مثبت بود سرور DC بر روي Root hints خود در DNS كليه اطلاعات مربوط به سرور
Root DNS را Add مي كند اگر سرور Root DNS در شبكه وجود نداشت سرور DC سرويس DNS خود را به Root DNS تبديل مي كند يعني يك Zone
از نوع Root در خود ايجاد مي كند بعد از نصب ADS بر روي سرور DC سيستم Restart مي شود بعد از Logon كردن سرويس Netlogon يك سري ركورد
بر روي DNS ايجاد مي كند اين ركودها براي مشخص شدن نام Domain Controller و نيز دسترسي ديگر Computer هاي شبكه به آن لازم مي باشد

locator records (A, SRV, and CNAME)

يك DNS سرور به تنهايي در يك شبكه مي توان نصب كرد اما در زمان راه اندازي يك ADS نيز مي توان DNS خود را به شبكه معرفي كرده و نصب كنيد
تفاوت يك DNS جدا از ADS با يك سروري كه ADS,DNS را با هم برروي خود داشته باشد به ترتيب زير مي باشد
امكان مشكلات براي يك DNS به حداقل مي رسد و داراي Security بالا مي باشد و نيز به آساني مي توان آن را Manage كرد و عمل Replica بين سرورهاي
DNS بسيار بهتر انجام مي شود
  • Increased fault tolerance
  • Security
  • Easier management
  • More efficient replication of large zones
بعداز نصب ADS شما بايد Zone موجود بر روي DNS كه به نامDomain شما ايجاد شده را به Parent Zone موجود در سرور Root DNS را Delegate
كنيد البته اگر شرطي كه در بالا گفته شد رعايت نشود يعني Root DNS در شبكه پيدا شود

After you have run the Active Directory Installation wizard, you might need to add a delegation in the parent zone of the zone you created. If this server is a root DNS server, there is no parent zone; therefore, you do not need to add a delegation. However, if there are other DNS servers that are running on the network, you must add a delegation.

To add a delegation

  1. Locate the zone that the Active Directory Installation wizard created. The Active Directory Installation wizard automatically creates a zone with the same name as the Active Directory domain you created.
  2. Locate the parent zone for this zone.
  3. On the parent zone, add the delegation.

Using the Configure DNS Server Wizard

بيشتر مواقع شما يك DNS را در زمان نصب ADS راه اندازي مي كنيد اما امكان دارد شما مي خواهيد يك DNS سرور جدا از Domain controller خود

داشته باشيد

براي اين كار اول بايد يكRoot DNS بر روي يكي از Hostهاي شبكه نصب كنيد به اين دليل بايدRoot DNS سرور ايجاد كنيد چون توسط سرويس Netlogon

بايد Locator Records در Zone Point ايجاد شود توسط DC . بعد از نصب سرويس DNS بايد موارد زير را انجام داد

  • Enable dynamic updates on that zone.
  • Unless this is a root zone, add a delegation to the new forward lookup zone in its parent zone.
  • Make sure that the server that will be a domain controller has network connectivity to this server.

شما بايد عضو گروه Administrators باشيد و مرا حل بالا را بر روي Host انجام دهيد اما اگر بروي DC اين مراحل را انجام دهيد بايد حداقل عضو يكي از اين

گروه ها باشد

  • DNS Administrators
  • Domain Administrators
  • Enterprise Administrators

قبل از راه اندازي و Config كردن DNS SERVER بايد مراحل زير را بروي DNS Client را چك كنيد كه اعمال شده باشد

To verify DNS client settings

  1. Right-click My Network Places, and then click Properties.
  2. Right-click the connection for which you want to configure the DNS server, and then click Properties.
  3. Click Internet Protocol (TCP/IP) and then click Properties.
  4. On the Internet Protocol (TCP/IP) Properties page, enter the IP address of the existing DNS server in the Preferred DNS server field. You can also add the IP address of an alternate DNS server in the Alternate DNS server field.
  5. If you need to specify more than one alternate DNS server, click Advanced, click the DNS tab, and then enter the servers in the DNS server addresses box.

براي نصب سرويس DNS بايد مراحل زير را انجام داد

To install the DNS server

  1. In Control Panel, double-click Add/Remove Programs, and then click Add/Remove Windows Components.
  2. Click Components, and then click Next.
  3. Click Networking Services, and then click Details.
  4. If it is not already selected, select the check box next to Domain Name System (DNS), and then click OK.
  5. Click Next. Windows 2000 installs DNS.
  6. Click Finish.

مرحله بعد Config كردن سرويس مي باشد كه بايد مراحل زير را انجام داد

To configure the DNS server

  1. In Control Panel, double-click Administrative Tools and then double-click DNS.
  2. Click the DNS server to expand it.
  3. Right-click the name of the server, and select Configure the server from the context menu. The Configure DNS Server wizard starts and guides you through the process of setting up DNS. In some cases, this includes creating a reverse lookup zone. For more information about creating a reverse lookup zone, see "Adding a Reverse Lookup Zone" later in this chapter.
  4. Optionally, if Active Directory has already been installed, integrate the zone with Active Directory. For information about integrating the zone with Active Directory, see "Active Directory Integration and Multimaster Replication" later in this chapter.

در زمان راه اندازي Configuration از شما سوال مي شود آيا نياز به ساختن هر دو نوع Zone Lookup داريد يا خير منظور Forward ,Reverse

The Configure DNS Server wizard prompts you for all the information needed to create the appropriate forward and reverse lookup zones

بهتر است كه جواب سوال را Yes بدهيد با Reverse Lookup در بخش Adding a Reverse Lookup Zone آشنا خواهيد شد

در مرحله آخر شما براي راه اندازي سرويس DNS كه از Active Directory پشتيباني كند بايد موارد زير را انجام دهيد

To configure the DNS server to support Active Directory

  1. Make sure that you have a forward lookup zone that is authoritative for the resource records registered by Netlogon.
  2. Configure the forward lookup zone to enable dynamic update.
  3. Unless this DNS server is a root DNS server, from the parent server, delegate the forward lookup zone to this server.

Adding a Reverse Lookup Zone

سرويس Active directory براي كار با DNS نيازي به PTR Resource Records ندارد اين ركوردها در Reverse Lookup Zone قرار دارند
اما براي شناسايي يك FQDN از طريق IP Address به اين ركوردها نياز مي باشد بسياري از Application هاي موجود براي شناسايي Clients ها از PTR
ركورد استفاده مي كنند

Planning for Reverse Lookup Zones

شما براي ساختن اين ركوردها اول بايد مشخص كنيد كه آيا كليه Subnet رامي خواهيد داراي اين ركورد بكنيد يا قسمتي از آن (Subnetted or class-based)
اگر شبكه شما داراي دو يا چند Subdomains مي باشد لازم نيست كه هر يك از آنها داراي يك Reverse Lookup Zone باشند براي هر يك ازآنها PTR
ركورد و Reverse Lookup Zone دريك Primary DNS Server مي توان Add كرد
However, organizing your reverse lookup zones along class C boundaries might not always be possible. For example, if your organization has a small network, you might have received only a portion of a class C address from your ISP. Table 6.3 shows how to configure your network with each type of subnet.

Table 6.3 Planning Reverse Lookup Zones

Network Type | Recommended Action | See Section in This Chapter
Class A network | Configure your reverse lookup zone on the primary name server for the top-level domain. | "Configuring a Standard Reverse Lookup Zone"
Class B network | Configure your reverse lookup zone on the primary name server for the top-level domain. | "Configuring a Standard Reverse Lookup Zone"
Class C network | Configure your reverse lookup zone on the primary name server for the top-level domain. | "Configuring a Standard Reverse Lookup Zone"
Subnetted class A network | Divide your network into class B or C networks. | "Configuring a Standard Reverse Lookup Zone"
Subnetted class B network | Divide your network into class C networks. | "Configuring a Standard Reverse Lookup Zone"
Subnetted class C network, owner of class C network manages the reverse lookup zone | Rely on the owner of the class C network to manage the reverse lookup zone. | Not applicable.
Subnetted class C network, owner of class C network has delegated the reverse lookup zone for your network to you | Configure a classless In-addr.arpa reverse lookup zone. | "Configuring and Delegating a Classless In-addr.arpa Reverse Lookup Zone"

Configuring a Standard Reverse Lookup Zone

براي Add كردن يك Reverse Lookup Zone مراحل زير را بايد انجام داد

To add a reverse lookup zone

  1. In Control Panel, double-click Administrative Tools and then double-click DNS.
  2. Optionally, if the server to which you want to add a reverse lookup zone does not appear in the list, right-click DNS, click Connect to Computer, and then follow the instructions to add the desired server.
  3. To display the zones, click the server name.
  4. Right-click the Reverse Lookup Zones folder, and click New Zone. A zone configuration wizard appears.
سيستم هاي Windows 2000-base و سرويس DHCP به صورت خودكار مي توانند PTR Record را در DNS ايجاد كنند اما به صورت دستي هم مي توان
اين عمل را انجام داد مراحل اين كار را در زير مي بينيد

To add PTR resource records

  1. In Control Panel, double-click Administrative Tools and then double-click DNS.
  2. To display the zones, click the server name.
  3. Right-click the zone in the Reverse Lookup Zones folder, point to New, and then point to Pointer.
  4. To create the PTR resource record, follow the instructions in the dialog box.

Configuring and Delegating a Classless In-addr.arpa Reverse Lookup Zone

اگر شما در يك شبكه مثلا در Class C دو يا چند Subnet ايجاد كرده باشد لازم نيست كه در هر Subnet يك DNS سرور ايجاد كنيد و در هر يك يك
Reverse Lookup Zone البته اين بستگي به انتخاب Admin دارد ولي مي توان كليه اين Reverse Lookup Zones ها را دريك Primary DNS
ايجاد كرد

شما مي توانيد يك سري از IP Address هاي داخل شبكه را براي يك يا چند گروه مجزا توضيع كنيد يا پخش كنيد به عنوان مثال شما در Class C يك شبكه

با نام Reskit داريد و مي خواهيد براي Branch offices اين آدرسها را مشخص كنيد اما شما به DNS سرور Branch دسترسي نداريد براي اين كار شما

بايد از يك Classless reverse lookup zones استفاده كنيد و آن را به Beranch offices نيز Delegate كنيد براي مثال شما از يك ISP

در Class C يك سري IP دريافت مي كنيد كه 62 آدرس IP اول آن به شما داده مي شود يعني به Reskit . در ISP مي توان ركوردهاي موجود در Zone Reskit

را نمايش داد البته توسط Classless in-addr.arpa reverse lookup zone توسط اين گزينه Reskit مي تواند قسمتي از Namespace را براي عمل

IP address–to–host mappings را Manage كند

در ابتدا بايد در ISP يك Delegate reverse zone ايجاد شود و سپس در Reskit.com نيز بايد يك Reverse lookup zone ايجاد كرد

به ترتيبي كه در زير شرح داده مي شود

براي اين كار اول بايد نحوه عمل اين گزينه از DNS را بررسي كنيد .

For more information about delegating reverse lookup zones, see the Request for Comments link on the Web Resources page at:

http://windows.microsoft.com/windows2000/reskit/webresources. Search for RFC 2317, "Classless in-addr.arpa delegation."

Dynamic update does not work with classless in-addr.arpa zones. If you need to dynamically update PTR resource records, do not use classless zones.

Syntax of a Classless In-addr.arpa Reverse Lookup Zone

<subnet-specific label>.<octet>.<octet>.<octet>.in-addr.arpa
در اين قسمت اجزا يك Reverse lookup zone را مشاهده مي كنيد . در قسمت <octet> بصورت برعكس ترتيب يك IP Address قرارمي گيرد .در فسمت
<subnet-specific label> سه نوع Label وجود دارد
  • <minimum value of the subnet range>-<maximum value of the subnet range>
  • <subnet>/<subnet mask bit count>
  • <subnet ID>

<Minimum value of the subnet range>-<Maximum value of the range>

در اين نوع Label شما عدد اول و آخر يك Range از Host ها را مشاهده مي كنيد در اين مثال 62 host اول اين كلاس را در بر مي گيرد

در اين مثال تعداد IP: 192.168.100.0 Mask: 255.255.255.192 ==== subnet range = 192.168.100.0 .. .. .. 192.168.100.62

0-26.100.168.192.in-addr.arpa

<subnet>/<subnet mask bit count>
در اين قسمت تعداد بيت هاي استفاده شده در Subnet Mask را نمايش مي دهد در مثال تعداد 62Bits را نشان مي دهد

0/26.100.168.192.in-addr.arpa

<subnet ID>
در اين نوع نامي كه Admin براي يك Subnet انتخاب شده را نمايش مي دهد

Subnet1.100.168.192.in-addr.arpa

For more information about creating and delegating subnetted reverse lookup zones through text files, see the Microsoft TechNet link on the Web Resources page at:

http://windows.microsoft.com/windows2000/reskit/webresources. Search Microsoft TechNet using the phrases "subnetted reverse lookup zone" and "Windows NT."

Delegating a Classless Reverse Lookup Zone

معمولا عمل Delegate كردن در يك شبكه كه حتي Subnetting در آن اعمال شده انجام نمي شود اما امكان دارد شما در Class C مي خواهيد دو يا چند شبكه
را يكسان سازي كنيد يا ادغام سازي بين قسمتي از Class C خود داشته باشيد و يا ارتباط بين شبكه خود و شبكه Remote را نياز داريد كه ازفرستادن Traffic
از نوع Replication وZone Transfer دوري كنيد از اين گزينه استفاده مي شود

Figure 6.10 shows how an administrator for a class C reverse lookup zone would then configure its DNS server.
در شكل 6.10 از Subnet ID استفاده شده

Figure 6.10 Reverse Lookup Delegations
در زير مراحل Delegate كردن يك Reverse lookup zone را مشاهده مي كنيد

To delegate a classless reverse lookup zone

  1. On the DNS server for your domain, create a reverse lookup zone.

    For the preceding example, create the reverse lookup zone 100.168.192.in-addr.arpa. The reverse lookup zone is added on the server for ISP.com, not Reskit.com.

  2. Right-click the reverse lookup zone that you created, point to New Delegation.
  3. In the New Delegation wizard, enter the name of the delegated domain and the name and IP address of the delegated name server. In the preceding example, the delegated domain is 0-26.
  4. Right-click the reverse lookup zone and click New alias.
  5. Add CNAME records for all the delegated addresses.

    For example, for the IP address 192.168.100.5, create a CNAME record of 5 that points to 5.0-26.100.168.192.in-addr.arpa.

  6. Create the classless reverse lookup zone in the subdomain, by following the procedure in the following section.

Configuring a Classless In-addr.arpa Reverse Lookup Zone

شما بايد Classless reverse lookup zone را ايجاد كنيد اگر يك نفر به شما Delegate كرده باشد بعنوان مثال وقتي Admin در ISP به شما
Delegate كرد مانند مثالي كه در بالا زده شد شما در Reskit.com نيز بايد به ترتيب زير يك Classless In-addr.arpa Reverse lookup zone
ايجاد كنيد در شكل 6.11 مي توانيد اين Zone را مشاهده كنيد

Figure 6.11 shows how Reskit.com would configure its classless reverse lookup zone.

Figure 6.11 Classless Reverse Lookup Zone

To create a classless reverse lookup zone

  1. In the DNS console, click the server name to display configuration detail it, right-click the Reverse Lookup Zones folder, and then click Create a New Zone. The Add New Zone wizard appears.
  2. When you reach the Network ID page, in the field named Enter the name of the zone directly, enter the name of the classless reverse lookup zone.

    For example, type 0-26.100.168.192.in-addr.arpa.

Then add any necessary PTR resource records in that zone.

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Setting Up DNS for Active Directory


Winteacher.com DNS Active Directory Integration and Multimaster Replication Language:Farsi

2003-2005

> Part2 > DNS > Active Directory Integration and Multimaster Replication

S tandard DNS alone
وقتي در اين حالت يك DNS شروع به كار كند Primary DNS Server مي تواند يك Zone را تغيير دهد و اين تغييرات به Secondary Zone در سرور
Secondary DNS انتقال مي يابد در واقع عمل Zone Transfer رخ مي دهد

M ultimaster Replication

شما مي توانيد Primary Zone درون يك Active directory ذخيره كنيد با اين كار اين Zone به عنوان يك Object درون ADS Database قرار
مي گيرد و از اين به بعد هر وقت يك ADS عمل Replicate را شروع كرد Zone هاي DNS نيز Update مي شوند اما در اين حالت ديگر تمامي DC هاي
درون يك شبكه مي توانند تغييرات در يك Zone ايجاد كنند اگر در يك Domain چند DC وجود داشته باشد كليه آنها مي توانند اين Replicate درون Zone
را ايجاد كنند اين عمل را به دليل اينكه چند Domain controller در آن مي تواند نقش داشته باشد را M ultimaster Replication مي گويند
در حالت Standard DNS شما عمل Replica را بين Primary DNS با Secondary DNS را انجام مي دهيد اما در حالت Integration ADS اين
عمل در ميان Replicate بين دويا چند DC انجام مي گيرد و داراي دقت بالاتري مي باشد و در شبكه هاي بزرگ بايد از اين مورد استفاده كرد و Security بالا نيز
ديگر دليل استفاده آن در شبكه هاي بزرگ مي باشد راحتي در Manage كردن نيز دليل ديگر مي باشد
Active Directory–integrated storage provides the following benefits:

Fault Tolerance Although you can still perform standard zone transfers with Active Directory–integrated zones, Active Directory multimaster replication provides greater fault tolerance than using standard zone transfers alone. Standard zone transfers and updates rely on a single primary DNS server to update all the secondary servers. With Active Directory replication, however, there is no single point of failure for zone updates.

Security You can limit access to updates for any zone or record, preventing insecure dynamic updates. For more information about configuring secure dynamic update, see "Dynamic Update and Secure Dynamic Update" later in this chapter.

Simpler Management Because Active Directory performs replication, you do not need to set up and maintain a separate replication topology (that is, zone transfers) for DNS servers.

More Efficient Replication of Large Zones Active Directory replicates on a per-property basis, propagating only relevant changes. This is more efficient than full zone transfers.

Integrated Storage

Figure 6.12 Active Directory-Integrated Zone

درمرحله اول يا Step 1 در شكل بالا DNS Component در واقع يك Copy از Zone را در خود دارد بدين معني كه در زمان Startup سرويس يك Copy
از Zone كه در Active Directory وجود دارد را گرفته و در خود نگهداري مي كنيد خلاصه مطلب اين كه Zone را از ADS در واقع Read مي كند
در Step 2 اگر تغييراتي در Zone ايجاد شود DNS آن را به ADS ارسال مي كند درواقع آن را در Zone موجود در ADS Database درج مي كند و
يا Write مي كند

Replication and Zone Transfer

Figure 6.13 Replication and Zone Transfer

امكان اين كه يك Primary DNS سرور در زمان Active Directory Replication از طريق Zone Transfer به يك Secondary DNS اطلاعات يك
Zone را مانند يك Copy ارسال كند همانطور كه در شكل بالا مي بينيد البته بايد از طرف Secondary DNS اين درخواست فرستاده شود
Load data on startup
به صورت Default يك Active Directory integrated DNS server در زمان Startup چك مي كند كه آيا در خود DNS Zone وجود دارد ياخير اگر
جواب مثبت بود DNS Server شروع به Load كردن آن Zone از ADS مي كند
اين Load كردن به سه صورت مي تواند باشد اين گزينه در Properties page در سرويس DNS بر روي سرور مي باشد

حالت اول From registry مي باشد

If Load data on startup is set to From registry, the DNS server loads all local standard zone files and Active Directory–integrated zones specified in the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Zones

حالت دوم Boot From File مي باشد

If Load data on startup is set to Boot From File, the DNS server uses a BIND-style boot file to determine the location of the zone files.

حالت سوم Boot from Active Directory and Registry

From Active Directory and registry (the default)

If Load data on startup is set to From Active Directory and registry (the default), the DNS server loads all Active Directory–integrated zones in the directoryand all local standard zone files specified in the registry. (The DNS server must load all the files in the directory; you cannot configure the DNS server to load only some of the zones.)

The DNS server automatically writes back to the boot file at regular intervals. You can also update the boot file by clicking on the server from within the DNS console and then by clicking the Action menu and selecting Update Server Data Files. Alternatively, you can stop and restart the server to update the boot file by right-clicking on the server from within the DNS console, pointing to All Tasks in the context-sensitive menu, and then clicking Restart.

سرور DNS هميشه اين موارد root hints and server and zone parameters را Load مي كند البته اين بستگي به نوع Load data on startup

دارد كه كدام نوع باشد

  1. Load data on startup = Boot from File
  2. Load data on startup = Boot from Registry
  3. Load data on startup = Boot from Active Directory and Registry
در جدول زير كاملا مي توانيد مراحل كار خواندن root hints and server and zone parameters را بر اساس نوع Load data on startup كه شما
انتخاب كرده ايد را مشاهده كنيد

Table 6.4 How the DNS Server Loads Zones, Root Hints, and Parameters

 | Load Data on Startup: Boot from File | Load Data on Startup:Boot from Registry | Load Data on Startup:Boot from Active Directory and Registry
Read root hints from: | Root hints file | If available, the root hints file. Otherwise, if the Directory is available and contains root hints, the Directory. | If the Directory is available and contains root hints, from the Directory. Otherwise, the root hints file.
Write root hints to: | Root hints file | Root hints file. | If the Directory is available, the Directory.
Read zones from: | Boot file | Registry. | The Directory (for Active Directory–integrated zones) and the registry.
Write zones to: | Boot file and the registry | Registry and, if the zone is Active Directory–integrated, the Directory. | Registry and, if the zone is Active Directory–integrated, the Directory.
Read server and zones parameters from: | Boot file and the registry | Registry and (for Active Directory–integrated zones) the Directory. | The Directory (for Active Directory–integrated zones) and the registry.
Write server and zones parameters to: | Boot file and the registry | Registry (for all zones) and (for Active Directory–integrated zones) the Directory. | The Directory (for Active Directory–integrated zones) and the registry.

If you change the setting of Load data on startup ?

در اين زمان DNS Server اول كليه اطلاعات مربوط به root hints , zones , parameters را بر اساس نوع جاري Load data on startup درجاي تعريف

شده Save و يا Writes مي كند سپس نوع جديد Load data on startup را Read مي كند براي ايجاد Setting جديد

سرور در حالت Active Directory–integrated zones در زمانهاي مشخصي Actice Directory را چك مي كند كه Zone جديد ايجاد نشده باشد يا Zone

پاك نشده باشد

dynamic updates

يك DNS Server مي تواند يك Active Directory را Modify و يا Update كند البته اگر dynamic updates را Admin فعال كرده باشد

در زمان Update شدن Active directory توسط DNS Server البته اگر شرط بالا رعايت شده باشد مراحل زير رخ مي دهد

وقتي update رخ مي دهد DNS Server به Zone كه در Memory خود Load كرده از ADS نگاه مي كند اگر تفاوتي با Zone موجود در Active Directory

داشت بعد از مراحلي آن را بر روي Primary Zone به ثبت رسيده در ADS Database خود write مي كند

DNS servers update Active Directory by using the following procedure:

  1. When an update occurs, the DNS server polls Active Directory to make sure that the copy of the zone in the memory of the DNS server is up to date. If not, the DNS server polls for any changes and incorporates those changes in the in-memory copy.
  2. Next, the server verifies that all prerequisites are satisfied. Prerequisites are conditions that must be satisfied before records can be updated.
  3. Finally, to accept the change, it updates the primary zone data in Active Directory.

Storage Location

Active Directory يك Object-oriented database مي باشد و هر يك از Resource هايش بعنوان يك Object در خود نگهداري مي كند

هر Object درون ADS داراي يك Attribute مي باشد كه مشخصه آن سرويس يا Object مي باشد تمامي اين موارد در Active Directory SCHEMA

نگهداري مي شود

Table 6.5 shows the DNS objects in Active Directory.
Object | Description
dnsZone | Container created when a zone is stored in Active Directory
dnsNode | Leaf object used to map and associate a name in the zone to resource data
dnsRecord | Multivalued attribute of a dnsNode object used to store the resource records associated with the named node object
dnsProperty | Multivalued attribute of a dnsZone object used to store zone configuration information.

در شكل زير مشاهده مي كنيد كه كليه اطلاعات درون يك Primary DNS درون يك ADS بعنوان يك Object مي باشد

Figure 6.14 shows how DNS objects are represented in Active Directory.

در قسمت MicrosoftDNS درون ADS شما مي توانيد dnsZone object مشاهده كنيد

  • The reverse lookup zone, 72.16.172.in-addr.arpa
  • The forward lookup zone, reskit.com
  • The root hints, RootDNSServers

در درون dnsZone شما مي توانيد شما مي توانيد dnsNode را مشاهده كنيد مانند Reskit.com درون dnsNode موارد زير مشاهده مي شود

تذكر براي ديدن dnsRecord شما نمي توانيد در Active Directory Users and Computers component آن را مشاهده كنيد

  • @, which signifies that the node has the same name as the dnsZone object.
  • delegated, a delegated subdomain.
  • host.notdelegated, a host in the domain notdelegated.reskit.com, a domain that is controlled by the zone on reskit.com.
  • host1, a host in the domain reskit.com.
  • mailserver, the mail server in the domain reskit.com.
  • nameserver, the name server in reskit.com.
  • notdelegated, the domain notdelegated.reskit.com, which is controlled by the zone on reskit.com.

براي نمايش دادن DNS object درون Active Directory بايد مراحل زير را انجام داد

To view zones stored in Active Directory

  1. Click Start, point to Programs and Administrative Tools, and then click Active Directory Users and Computers.
  2. In the View menu, click Advanced Features.
  3. Double-click the Domain object, the System object, and then the MicrosoftDNS object to display the dnsZone objects.
  4. Double-click the zone that you want to view.

Creating, Converting, and Deleting Zones

شما در Active Directory integration Zone مي توانيد يك Primary Zone و يا Secondary Zone را Convert كنيد به يك

Active Directory integration Zone و برعكس زماني كه يك Zone جديد ساخته شد اين Zone توسط خود ADS عمل Replica بين اين Zone و ديگر

Zone هاي موجود در Domain انجام مي شود و اين مديريت توسط ADS انجام مي شود

If you create a zone on one domain controller, and then create the same zone on a second domain controller before Active Directory has replicated the zone, Active Directory deletes the zone on the first domain controller. As a result, you lose any changes that you made to the version of the zone that you created on the first domain controller.

Converting a Standard Zone to an Active Directory–Integrated Zone

يك Standard primary or secondary Zone را مي توان به يك Active Directory integrated zone تبديل كرد

اما قبل از انجام اين كار بايد به موارد زير توجه كرد

اول اينكه سرويس DNS كه از Active Directory Integrated Zone استفاده مي كند بايد بر روي يك Domain Controller در شبكه Run باشد

شما نمي توانيد از Active Directory Integrated zone ديگري كه در Domain متفاوت وجود دارد استفاده كنيد

در اين بحث Active Directory Integrated Secondary Zone وجود ندارد در زماني كه يك Zone از اين نوع ساخته شد كليه Domain Controller

موجود در Domain مي توانند Zone را Update كنند

در يك زمان شما نمي توانيد دو Active Directory Integrated Zone يكسان داشته باشيد

Converting an Active Directory–Integrated Zone to a Standard Zone

شما مي توانيد يك Active Directory Integrated Zone را به يك Standard Secondary Zone تبديل كنيد اين كار زمان زيادي را نمي گيرد

شما مي توانيد يك Active Directory Integrated Zone را به يك Standard Primary Zone تبديل كنيد بعد از اين كار Zone از ADS پاك مي شود

Deleting Zones

اگر يك Active Directory Integrated Zone را شما Delete كنيد و Load Data in startup=Registry باشد DNS Console از شما سوال مي كند

مي خواهيد براي هميشه پاك شود اگر جواب Yes باشد اين Zone بطور كامل پاك مي شود اما اگر جواب No باشد اين Zone از Registry پاك مي شود اما در ADS

باقي مي ماند در زمان بعدي كه ADS به خود رجوع مي كند براي چك كردن اينكه آيا يك Zone جديد ايجاد شده يا پاك شده اگر Load data in startup را در حالت

From Active Directory and registry باشد اين Zone دوباره ظاهر خواهد شد اما اگر در حالت Registry باشد اين Zone ديگر ظاهر نخواهد شد

تذكر بعد از پاك شدن يك Zone آن ديگر قابل Load و دسترسي بر روي هيچ يك از Domain Controller هاي شبكه نخواهد بود

If you delete a standard secondary zone from a domain controller, it is generally deleted from that domain controller. However, if a corresponding Active Directory–integrated zone exists, and you have configured the DNS server to load data on startup from Active Directory and the registry, the zone reappears as an Active Directory–integrated primary zone. You can then delete the Active Directory–integrated zone from the computer or from Active Directory.

Creating a Secondary Copy of an Active Directory–Integrated Zone

شما مي توانيد يك Copy از نوع Secondary از يك Active Directory Integrated Zone ايجاد كنيد البته به معني

Active Directory Integrated Secondary Zone نمي باشد چون همه اين Integrated Zone ها از نوع Primary مي باشند و به دلبلي كه در

MultiMaster Replication توضيح داده شد . معمولا براي اينكه افراد در يك شبكه Remote بتوانند Name Resolution انجام بدهند از شبكه شما مي توان

يك Secondary Copy از Zone خود را براي DNS Server شبكه Remote قرارداد. البته بهتر است كه با اضافه كردن يك Domain Controller درشبكه

Remote و استفاده از Traffic DC Replication اين كار را انجام دهيد ولي اين روش ممكن است بار كاري بين دو شبكه رابالا ببرد اين بستگي به انتخاب Admin

دارد

Preventing Problems When Converting or Deleting Zones

اگر شما در يك شبكه يك Active Directory Integrated Zone را به Standard Primary Zone تبديل كنيد موجب ERROR براي

Secondary server مي شود به ترتيبي كه در زير شرح داده مي شود

زماني كه شما يك Integrated Zone را پاك يا Convert مي كنيد اين Zone تبديل مي شود در مورد Convert به يك Standard Primary Zone

در اين ميان اين Zone از كليه Domain Controller هاي شبكه نيز پاك مي شود در اين ميان كه يك Secondary Zone كه كپي از يك Integrated Zone

بوده در زمان Zone Transfer بدون جواب مي ماند و Error رخ خواهد داد

در شكل 6.15 فرص كنيد كه Domain بانام noam.reskit.com وجود دارد در اين Domain دو Active directory Integrated Zone با نام هاي

DC1.noam.reskit.com and DC2.noam.reskit.com وجود دارد كه براي يكي از آنها يك Secondary Server با نام

SecondaryNS.noam.reskit.com ايجاد شده در زماني كه سرور DC1 به هر دليلي Integrated Zone خود را به Standard Primary Zone تبديل

كند اين Zone در سرور DC2 نيز پاك مي شود چون اين Zone بر روي DNS موجود در DC2 پاك شده سرور SecondaryNS ديگر نمي تواند از Zone

موجود در DC2 براي Replication استفاده كند مشكل رخ مي دهد . در شكل 6.16 مي توان اين مشكل را كامل ديد

راه حل تبديل آن Zone به يك Standard Secondary Zone مي باشد چون اين نوع Zone در DC ها باقي مي ماند و پاك نمي شود

Figure 6.15 Sample Domain Structure
Now, suppose that a user with the proper permissions logs on to DC1.noam.reskit.com and converts the zone from an Active Directory–integrated zone to a standard primary zone. As Figure 6.16 shows, DC1.noam.reskit.com will have a standard primary zone, and DC2.noam.reskit.com will not have a copy of the zone. Even though the zone is deleted from DC2.noam.reskit.com, SecondaryNS.noam.reskit.com still points to DC2.noam.reskit.com as the master server from the zone, and SecondaryNS.noam.reskit.com has no way to get a copy of the zone by using zone transfers.
Figure 6.16 Orphaned Secondary Server
To prevent this problem, be sure to update all secondary servers for the zone that you are converting from an Active Directory–integrated zone to a standard primary zone.

This problem occurs only if you delete a zone from a server or you are converting an Active Directory–integrated zone to a standard primary zone, and a secondary server is pointing at a server from which the zone was deleted. The problem will not occur if you are converting an Active Directory–integrated zone to a standard secondary zone, because converting an Active Directory–integrated zone to a standard secondary does not cause the zone to be deleted from any server.

Multimaster Replication

سرويس Active Directory در زمان Replication يك MultiMaster Replication ايجاد مي كند يعني تمامي Domain Controller هاي يك Domain

مي توانند براي Update كردن همديگر اطلاعات Send or Receive كنند در اين Process هر Zone آخرين تغييرات خود را براي ديگر Zone هاي ارسال مي كند

تا درآخر كليه Zone ها داراي Records هاي يكسان باشند و دراين نوع هميشه كليه DC ها مي توانند Zone هاي همديگر را Update كنند

When you store a primary zone in Active Directory, the zone information is replicated to all domain controllers within the Active Directory domain. Every DNS server running on a domain controller is then authoritative for that zone and can update it.

Name Collisions

امكان دارد بر روي يك Zone در يك Domain در يك لظه بر روي دو DC متفاوت يك ركورد يكسان Modify شود البته حتما هم نبايد در يك لحظه باشد در زمان

Replication چه اتفاقي رخ مي دهد ADS در اين زمان به version number آن ركوردها نگاه مي كند و آن ركوردي كه سريال آن عدد بالاتري دارد را ارجح تر

مي باشد اگر اين عدد يكسان بود به timestamp هر ركورد نگاه مي كند و آحرين را انتخاب مي كند و ركورد دومي را حذف مي كند

For more information about replication collisions, see "Active Directory Replication" in the Microsoft® Windows® 2000 Server Resource Kit Distributed Systems Guide.

replication collision

امكان دارد يك شحصي در يك زماني Property يك Active Directory object واقع در يك Zone را تغيير دهد يا Update كند در آن زمان

د ر آن Domain يك فردي نيز همان Object را در Property اش تغييراتي انجام بدهد در اينجا يك Object با دو Property متفاوت در يك Domain ايجاد

شده زماني كه يك Propertyدر يكDC تغيير كند قبل از اينكه درDC هاي ديگر تغيير كند زماني كه عمل Replication بين DC رخ مي دهد replication collision

رخ مي دهد

در اين زمان Active Directory تصميم مي گيرد كه با دو dnsNode object متفاوت كه نام يكساني دارند چه برخوردي بكند در اين موقعيت سيستم نام Object را

تغيير مي دهدالبته آن Object را كه اول Add شده را تغيير نام مي دهد تا در نتيجه دو Object با دو نام متفاوت داشته باشيم سپس DNS رجوع مي كند به ADS و

آن ركوردي را كه تغيير نام داده شده را پاك مي كند و آخرين ركورد را قبول مي كند براي Replication بين ديگر سرورها

Causing Immediate Replication

امكان اينكه بصورت دستي وفوري يك Replication بين سرور ها ايجاد كرد نيز وجود دارد اين در زماني مي باشد نمي خواهيد صبر كنيد تا بصورت Normal اين

عمل انجام شود البته اين عمل در زمانهاي مشخصي از شبانه روز انجام مي شود . لبته بهتر است زماني كه Traffic Network شما بالا نيست اين عمل را انجام دهيد

براي انجام اين كار مراحل زير را بايد انجام دهيد .

To cause immediate replication

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Sites and Services.
  2. Double-click the Sites icon to expand it.

    All sites are displayed — including the first site, labeled Default-First-Site-Name — and any other site that has been manually configured.

  3. Double-click the site that you want to expand.
  4. Under the site you want, double-click the Servers icon to expand it, and then expand the icon for the computer. The NTDS Settings icon is displayed.
  5. Click the NTDS Settings icon.

    One or more objects are listed in the right pane. One of those objects is a link to the domain controller on which you want to cause immediate replication.

  6. Right-click the object that links to the domain controller on which you want to cause immediate replication, and then click Replicate Now.

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Active Directory Integration and Multimaster Replication


Winteacher.com DNS Dynamic Update and Secure Dynamic Update Language:Farsi

2003-2005

> Part2 > DNS > Dynamic Update and Secure Dynamic Update

از اين گزينه در DNS زماني استفاده مي شود كه Client ها بتوانند خود ركوردهايي كه لازم دارند را در DNS Server خود تغيير دهند و سپس سرور آن ركوردها
را چك مي كند كه شرايط لازم براي وجود در Zone را دارا باشند .

Dynamic update provides the following benefits:

راه اندازي اين گزينه در هر سرور فوايدي دارد اول اينكه كليه DHCP Clients ها بصورت خودكار A and PTR records را در سرور Register مي كنند
كه اين خود باعث مي شود كه Admin دستي اين ركورد را ايجاد نكند . دوم سرور DHCP به نمايندگي از Client ها اين عمل كه در مورد اول گفته شد را مي تواند
انجام دهد اين عمل بهتر مي باشد چون ممكن است بعضي از Client ها نتوانند عمل Dynamic Update را انجام دهند
  • Enables clients, including DHCP clients, to dynamically register A and PTR resource records with a primary server. This reduces the administrative resources needed to manually manage those records.
  • Enables DHCP servers to register A and PTR resource records on behalf of DHCP clients. This reduces the time needed to manually manage those records and provides support for DHCP clients that cannot perform dynamic updates.
  • Simplifies the setup of Active Directory by allowing domain controllers to be dynamically registered by using SRV records.

Secure dynamic update provides the following benefits:

اما راه اندازي Secure اين گزينه نيز فوايدي دارد و قوانيني. در اين مورد فقط DNS سرور هايي كه در dnsNode object و dnsZone object وجود دارند

مي توانند ركوردهاي آن Zone را Update كند در اين روش فوايد زير وجود دارد كه اولا User هاي ناشناس نمي توانند ركوردها را Edit يا Modify كنند .

دوم اينكه شما مشخص مي كنيد كدام USERS يا Groups مي تواند اين ركوردها را دستكاري كنند .

  • Protects zones and resource records from being modified by users without authorization.
  • Enables you to specify exactly which users and groups can modify zones and resource records.

سيستم هاي Dynamic update Clients اول شروع به ارتباط از نوع Dynamic update مي كنند اگر جواب Fails بود نوع Secure dynamic update را
برقرارمي كنند بين خود و سرور. درآدرس Registry زير مي توان نوع Dynamic update را مشخص كرد.
در اين آدرس يك Value بنام UpdateSecurityLevel را اگر مقدار آن را موارد زير قرار دهيد مي توانيد نوع Dynamic update را مشخص كرد
  • 256. Specifies the use of secure dynamic update only.
  • 16. Specifies the use of insecure dynamic update only.
  • 0. Specifies the use of secure dynamic update when an insecure dynamic update is refused. This is the default value.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Dynamic Update

Dynamic update از طرف بعضي سرويس ها مي تواند ركوردها را براي سرور DNS بفرستد مانند DHCP Client and DHCP Server و Netlogon
و نيز Clustering Service.
در Windows 2000 Clients سيستم ها در سه حالت Network adaptor مي توانند اطلاعات Dynamic update را به سرور DNS ارسال كند
اين سه حالت كارت شبكه :DHCP adapters, statically configured adapters, and remote access adapters مي باشند.
بصورت پيش فرض يك dynamic update client فقط ركورد A resource record را Dynamic براي سرور ارسال مي كند اما اگر موارد زير رخ دهد
PTR Records نيز مي تواند در سرور DNS ثبت شود .
  • The TCP/IP configuration is changed.
  • The DHCP address is renewed or a new lease is obtained.
  • A Plug and Play event occurs.
  • An IP address is added or removed from the computer when the user changes or adds an IP address for a static adapter. (The user does not need to restart the computer for the dynamic update client to register the name–to–IP address mappings.)

در زمان Dynamic update هر Client وقتي از DHCP Server يك IP جديد بگيرد خود Client اقدام به register كردن name–to–IP address mappings

شما مي توانيد DHCP Server را بگونه اي تنظيم كنيد كه در زمان IP Lease كردن خود اين عمل را از طرف Clients ها انجام دهد و جلوگيري كنيد از انجام اين
عمل توسط Clients ها .

To prevent the client from registering name–to–IP address mappings
  1. Double-click the Network icon in Control Panel.
  2. Right-click the icon for the connection on which you want to disable registration of name–to–IP address mappings, and then click Properties.
  3. Click Internet Protocol (TCP/IP), and then click Properties.
  4. Click Advanced, and then click the DNS tab.
  5. Clear the check box Register this connection's address in DNS.

براي دوباره Register كرد مي توانيد از فرمانهاي زير استفاده كنيد
You can force a re-registration by using the command-line tool Ipconfig. For Windows 2000–based clients, type the
following at the command prompt:

ipconfig /registerdns

For Windows NT 4.0–based clients, type the following:

ipconfig /release

ipconfig /renew

For Microsoft® Windows® 98–based and Microsoft® Windows® 95–based clients, type the following:

winipcfg /renew

Dynamic Update Process

در مرحله اول Clients يك query به شبكه براي پيدا كردن DNS Server و نيز Zone مورد نظر خود كه در بايد اطلاعات Dynamic update را ثبت كند مي فرستد
سرور DNS شبكه بعد از پيدا كردن نام سرور مربوط به Client و نيز نام Zone مورد نظر آنها با يك جواب به Clients مي فرستد .در مر حله بعد Clients شروع به
فرستادن Dynamic update Records مي كند در اين ميان سرورDNS بعد از گرفتن اين ركورد ها قبل ثبت آنها بررسي مي كند كه آيا Secure Dynamic update
راه اندازي شده يا خير سپس اين ركوردها را ثبت مي كند . مراحل كار را در Figure 6.17 مي توانيد ببينيد.

Figure 6.17 shows a typical dynamic update process.

Updates can fail for the following reasons:

اما امكان دارد مراحل كار كه در بالا گفته شد بدلايلي انجام نشود كه در زير شرح داده مي شود .

The primary server that is authoritative for the name does not respond.

زماني كه سرور جوابي ندهد امكان دارد كه يا خاموش باشد يا در دسترس Clients نباشد و يا Replication بين Zone ها در جريان باشد .

The server is not accepting dynamic updates because the zone is being transferred.

در زماني كه يك Zone در حال Transfer كردن اطلاعات خود باديگر سرور ها باشد امكان اين وجود دارد كه ركوردهاي Dynamic update را قبول نكند

The server accepts only secure dynamic updates, and the insecure dynamic update operation failed.

For more information about secure dynamic update, see "Secure Dynamic Update" later in this chapter.

امكان دارد در اين زمان براي Zone تعريف شده باشد كه از Secure dynamic update استفاده شود .

The prerequisites have not been met. For example, the dynamic update client might be trying to update a name for

which no records currently exist.

امكان دارد دراين زمان Client ركوردي را بخواهد ثبت كند كه اين ركود در Zone وجود نداشته باشد

DHCP Clients and Servers

اما ارتباط بين DHCP Client و DNS Server و DHCP Server مي تواند چند حالت باشد .
در سيستم هاي Windows 2000 clients كه از DHCP براي خود IP مي گيرند نيازي نيست كه سرور DHCP ركورد A را براي DNS بفرستد اما مي تواند ركورد
PTR مانند شكل زير براي DNS ارسال كند اين فرايند در زمان كه سرور مدت زمان اجاره دادن IP به DHCP Client ها تمام شده و IP جديد به سيستم ها مي دهد رخ
مي دهد .

اما سيستم هاي PREwin2k مانند Win 95 ,Win 98,Win NT 4 اين امكان را ندارند كه FQDN خود را به DHCP سرور ارسال كنند به همين دليل مي توان تنظيم
كرد كه سرور DHCP در زمان دادن IP به آنها اين عمل را انجام دهد .در واقع FQDN هر Client را به DNS Server مي دهد.
براي انجام اين كار بايد در DNS Tab موجود در Properties-DHCP Server در DHCP Console مورد زير را Select كنيد

Enable updates for DNS clients that do not support dynamic updates

Dynamic Update Process for Adapters Configured by DHCP

در زماني كه DHCP Clients به سرور DHCP موجود در شبكه درخواست مبني بر گرفتن IP يا همان DHCPREQUEST packet را ارسال كرد FQDN هر
Client توسط اين Packet به سرور DHCP داده مي شود . و سرور DHCP توسط همين FQDN به Clients هاي خود جواب مي دهد يا همان Packet معروف

DHCP acknowledgment DHCPACK را به DHCP Clients ارسال مي كند. درجدول زير قسمت FQDN يك DHCPREQUEST packet را مشاهده مي كنيد

Table 6.6 Fields in the FQDN Option of the DHCPREQUEST Packet

Field | Explanation
Code | Specifies the code for this option (81).
Len | Specifies the length of this option (minimum of 4).
Flags Can be one of the following values:

0. Client wants to register the A resource record and requests that the server update the PTR resource record.

1. Client wants server to register the A and PTR resource records.

3. DHCP server registers the A and PTR resource records regardless of the request of the client.

RCODE1 and

RCODE 2

The DHCP server uses these fields to specify the response code from an A resource record registration performed on the client's behalf and to indicate whether it attempted the update before sending DHCPACK.
Domain Name | Specifies the FQDN of the client.
در جداول زير شما مي توانيد مراحل كاري سرور DHCP و سرور DNS در مورد Dynamic update را در دو نوع DHCP Client يعني Win2k و PREWin2k
را مشاهده كنيد در جدول زير مي توان ديد كه A resource Records و PTR resource Record چگونه و در چه حالتهايي قرارمي گيرند .

Figure 6.18 Windows 2000-based Client

در اين جدول سيستم هايي كه Dynamic Update را پشتيباني نمي كنند را مشاهده مي كنيد

Figure 6.19 Client That Does Not Perform Dynamic Updates (Pre Windows 2000-based)

Configuring Dynamic Update for DHCP Clients

در حالت پيش فرض در آدرس زير مشاهده مي كنيد كه سيستم كار Update كردن A resource record را خود انجام مي دهد و PTR resource record را
از سرور DHCP درخواست مي كند كه انجام دهد
  1. Right-click My Network Places, and then click Properties.
  2. Right-click the connection you want to configure, and then click Properties.
  3. Select Internet Protocol (TCP/IP), click Properties, and click Advanced, and select the DNS tab.
  4. By default, Register this connection's address in DNS is selected and Use this connection's DNS suffix in DNS registration is not selected, causing the client to request that the server update the PTR resource record and the client updates the A resource record using the primary DNS suffix.

Configuring Dynamic Update for DHCP Servers

To configure dynamic update for the Windows 2000 DHCP server

  1. Click Start, point to Programs and Administrative Tools, and then click DHCP.
  2. Expand the tree next to the name of the server.
  3. Right-click the scope you're configuring, and then click Properties.
  4. Click the DNS tab.
  5. If it is not already selected, select Automatically update DHCP client information in DNS.
  6. If you want the server to register whichever records the client requested that it register, select the option Update DNS only if DNS client requests.
  7. If you want the server to always register both A and PTR resource records, select the option Always update DNS.
  8. If you want the server to always register both A and PTR resource records on behalf of clients that do not support the FQDN option, select Enable updates for DNS clients that do not support dynamic update.

Automatically update DHCP client information in DNS.

اين گزينه براي راه اندازي و پشتيباني سرور DHCP از Dynamic update بايد فعال باشد

Update DNS only if DNS client requests.

اگر بخواهيم سرور هر دو ركورد را وقتي يك DHCP Client درخواست كرد Update كند بايد اين گزينه

را انتخاب كنيد

Always update DNS.

اين گزينه زماني انتخاب مي شود كه ما بخواهيم سرور هر دو ركورد را Update كند

Enable updates for DNS clients that do not support dynamic update.

اگر بخواهيم سرور از طرف سيستم هايي كه FQDN را پشتيباني نمي كنند نيز عمل Update كردن ركوردها را انجام دهد اين گزينه بايد فعال باشد

Discard forward (name-to-address) lookups when leases expire.

اگر اين گزينه را فعال كنيد سيستم بعد از پايان مدت زمان اجاره يك IP به يك DHCP Client در DNS ركورد A Resource Record را پاك مي كند

If you have any multihomed dynamic update clients and at least one adapter is using DHCP, select the option Update according to client request (the default). If the DHCP server is configured to register both A and PTR resource records, the DHCP server replaces all A resource records for the name it attempts to register.

For more information about the FQDN option and integration between DNS and DHCP, see the Internet Engineering Task Force (IETF) link on the Web Resources page at http://windows.microsoft.com/windows2000/reskit/webresources . Search for the IETF Internet-Draft "Interaction Between DHCP and DNS."

Statically Configured and Remote Access Clients

Statically configured clients and remote access clients اين نوع سيستم ها به DHCP Server براي ثبت ركوردهاي A , PTR اعتماد نمي كنند
Statically configured clients هر زمان كه شروع به كار كنند خود ركوردهاي A , PTR را در DNS ثبت مي كنند امكان دارد اين سيستم ها 24 ساعته روشن
باشند اين مورد امكان دارد باعث خراب شدن ركورد شود و نياز به Refresh شدن در طول شبانه روز دارد

Remote access clients اين نوع سيستم ها هر وقت كه Dial-up Connection آنها ساخته شود ركوردهاي A , PTR را مي سازند و هر وقت اين Connection

توسط User بسته شود اين ركوردها نيز پاك مي شود اگر در 4 ثانيه يك remote access client نتواند ركوردهاي خود را در DNS پاك كند بعد از بسته شدن
آن Connection يك ركورد خراب يا Stale record در Database سرور DNS بوجود مي آيد البته سرور RRAS معمولا خود اقدام به پاك كردن ركوردها از سرور
DNS مي كند .

Multihomed Clients

به سيستمي كه در شبكه بيشتر از يك Network Adapter دارا مي باشد مي توان Multihomed Clients گفت. معمولا اين سيستم ها كار ارتباط بين دو شبكه مجزا
را برعهده دارند .البته در شكل زير Adapter B مي تواند يك Modem باشد.
در شكل زير Client1.noam.reskit.com با يكDHCP Adapter با LAN ارتباط دارد و IP خود را در سرور NoamDC1 ثبت مي كند و با RAS Adapter نيز
به Internet متصل مي باشد كه IP خود را در سرور ISPNameServer موجود در Internet ثبت كرده.
در زمان Dynamic update نمي تواند هر دو IP Address را در دو سرور جداگانه ثبت كند يعني ركورد PTR را نمي تواند به دو سرور جدا از هم بفرستد ام در عوض
ركورد A را براي هر دو سرور مي فرستد و عمل name–to–IP address mapping براي هر دو Adapter انجام مي دهد

Figure 6.20 Dynamic Update for Multihomed Clients

STATUS

RECORD TYPE

ADDRESS

name–to–IP address mappings

A Resource record

  1. Right-click My Network Places, and then click Properties.

  2. Right-click the connection you want to configure, and then click Properties.

  3. Select Internet Protocol (TCP/IP), click Properties, and click Advanced, and select the DNS tab.

  4. select Register this connection's address in DNS

IP address–to–host mappings

PTR Resource record

  1. Right-click My Network Places, and then click Properties.

  2. Right-click the connection you want to configure, and then click Properties.

  3. Select Internet Protocol (TCP/IP), click Properties, and click Advanced, and select the DNS tab.

  4. select Use this connection's DNS suffix in DNS registration

Time to Live

هر وقت Dynamic update ركوردهاي PTR , A را در DNS به ثبت رساند اين ركوردها TTL= 20 Minutes شما مي توانيد با تغيير آدرس Registry زير

مقدار اين زمان را تغيير دهيد . در اين آدرس يك DWORD value بنام DefaultRegistrationTTL وجود دارد كه مدت زمان را مشخص مي كند مدت زمان بالا
Risk را بالا مي برد ولي ترافيك را پايين و مدت زمان كوتاه برعكس مي باشد .
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Resolving Name Conflicts

در زماني كه Dynamic update انجام مي شود Client متوجه مي شود كه نام يا IP Address كه مي خواهد در DNS ثبت كند قبلا توسط سيستم ديگري ثبت شده
سيستم بعد از اين اتفاق به سيستمي كه با آن Name conflict داشته رجوع مي كند براي تغيير IP آن و دادن يك IP Address جديد. اگر Zone در حالت
secure dynamic update تنظيم نشده باشد هر User مي تواند با تغيير IP اين مشكل را حل كند ولي در حالت secure dynamic update فقط افرادي كه
در گروه هاي خاصي قراردارند مي توانند اين عمل را انجام دهند
شما بجاي تغيير دادن IP Address مي توانيد عمل زير را انجام دهيد يعني در واقع كاري كنيد كه سيستم در Event viewer در زمان انجام اين خطا يك پيغام Error
را ايجاد كند براي اين كار در آدرس Registry زير بايد يك DWORD Value بنام DisableReplaceAddressesInConflicts با مقدار 1 ايجاد كنيد
The entry can be 1 or 0, which specify one of the following:
  • 1. If the name that the client is trying to create already exists, the client does not try to overwrite it.
  • 0. If the name that the client is trying to create already exists, the client tries to overwrite it. This is the default value.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Caution

Do not use a registry editor to edit the registry directly unless you have no alternative. The registry editors bypass the standard safeguards provided by administrative tools. These safeguards prevent you from entering conflicting settings or settings that are likely to degrade performance or damage your system. Editing the registry directly can have serious, unexpected consequences that can prevent the system from starting and require that you reinstall Windows 2000. To configure or customize Windows 2000, use the programs in Control Panel or Microsoft Management Console (MMC) whenever possible.

Secure Dynamic Update

شما مي توانيد از Secure Dynamic update در Active directory integrated Zone استفاده كنيد در اين زمان ACL مشخص مي كند كه كدام Users و يا

كدام Groups مي توانند يك Zone را Modify كنند .

access control list (ACL)
A list of security protections that apply to an entire object, a set of the object's properties, or an individual property of an object. There are two types of access control lists: discretionary and system. See also access control entry; discretionary access control list; security descriptor; system access control list.
Note

Secure dynamic update is available only on Active Directory–integrated zones.

Configuring Secure Dynamic Update

زماني كه شما يك Active directory Integrated Zone ايجاد مي كنيد بصورت Default نوع Secure dynamic update را بخود مي گيرد . اما زماني كه يك

Standard Primary Zone را به Active directory integrated Zone تبديل مي كنيد نوع Dynamic update را بخود مي گيرد .

براي تغيير نوع مراحل زير بايد انجام شود

To configure secure dynamic update

  1. In the DNS console, right-click the zone for which you want to configure dynamic update, and then click Properties.
  2. In the Allow dynamic updates? box, select Only secure updates.

Controlling Update Access to Zones

در Secure dynamic update فقط Computer ,Users كه در ACL مشخص شده اند مي توانند يك dnsNode object ايجاد كنند يا Modify كنند . پيش فرض

ACL به كليه Authentication User groups و كليه Authentication computers groups موجود در ADS كه Forest باشد Permission مي دهد براي

Create and Modify كردن dnsNode objects موجود در شبكه معمولا Creator owner هر object بر آن Permission از نوع Full Control دارد .

شما مي توانيد Permission افراد را از طريق DNS Console و يا از طريق Active directory Users and Computers console تغيير دهيد

DNS Console

To view the ACL for a dnsZone or dnsNode object

  1. In the DNS console, right-click the zone or record you want to view, and then click Properties.
  2. Click the Security tab.
Active directory Users and Computers console
You can view and change the permissions for all DNS objects on the Security tab for the object, from within the Active Directory Users and Computers console

Note

ACLs are assigned on a per-name basis. Therefore, if you had two different records for the same FQDN, they map to the same object in Active Directory and have the same ACLs. For example, the following records have the same ACLs:

به هر نامي يك ACL واگذار مي شود بنابراين اگر دو ركورد متفاوت در مورد بك نام يا يك FQDN يكسان داشته باشيم هر دوي آنها در يك object يكسان قرارمي گيرند

بنابراين اگر مثال زير را در نظر بگيريم بايد بدانيم كه هر دوي آنها ACLs يكساني دارند

host1.reskit.com A 172.16.15.9

host1.reskit.com MX mailer.reskit.com

Reserving Names

You can reserve FQDNs so that only certain users can use them. To do so, create the FQDN in the DNS console, then modify its ACL so that only particular computer, user, or users can change the set of records associated with the FQDN.

DNS Standards for Secure Dynamic Update

Windows 2000 supports secure dynamic updates through the Generic Security Service Application Program Interface (GSS-API, specified in RFC 2078) rather than Domain Name System Security Extensions (RFC 2535) or Secure Domain Name System Dynamic Update (RFC 2137). The GSS-API provides security services independently of the underlying security mechanism.

The GSS-API specifies a way to establish a security context by passing security tokens. The client generates the initial token and sends it to the server. The server processes the token and, if it is necessary, returns a subsequent token to the client. The process repeats until negotiation is complete and a security context has been established. After the security context has been established, it has a finite lifetime during which it can be used to create and verify the transaction signature on messages between the two parties.

Windows 2000 implements the GSS-API using an algorithm specified in the IETF Internet-Draft "GSS Algorithm for TSIG (GSS-TSIG)." This algorithm uses Kerberos v5 authentication protocol as its underlying security mechanism. Other security providers such as smart cards or certificates have not been tested. The algorithm uses the following resource records to provide security services:

TKEY. A resource record specified in the IETF Internet-Draft "Secret Key Establishment for DNS (TKEY RR)," as the vehicle to transfer security tokens between the client and the server and to establish secret keys to use with the TSIG resource record.

TSIG. A resource record specified in the IETF Internet-Draft "Secret Key Transaction Signatures for DNS (TSIG)," to send and verify signature-protected messages.

To see the TKEY and TSIG records being passed across the network, you can use Network Monitor. Versions 6.12 and later decode the resource records.

TKEY Resource Record

Table 6.7 describes the structure of the TKEY resource record, as described in the IETF Internet-Draft "Secret Key Establishment for DNS (TKEY RR)."

Table 6.7 TKEY Resource Record

Field | Data Type | Comment
NAME | domain name | Differs with mode and context
TTYPE | u_int16_t | TKEY
CLASS | u_int16_t | Ignored; should be zero
TTL | u_int32_t | Should be zero
RDLEN | u_int16_t | Length of RDATA field
RDATA |  |
Algorithm | domain name | Determines how the secret keying material exchanged by using the TKEY resource record is used to derive the algorithm-specific key
Inception | u_int | In number of seconds since January 1, 1970 GMT
Expiration | u_int32_t | In number of seconds since January 1, 1970 GMT
Mode | u_int16_t | Scheme for key agreement
Error | u_int16_t | Error code
Key size | u_int16_t | Size of Key data field in octets
Key data | octet stream | Differs with mode
Other size | u_int16_t | Not used
Other data | octet stream | Not used

TSIG Resource Record

Table 6.8 describes the structure of the TSIG resource record, as described in the IETF Internet-Draft "Secret Key Transaction Signatures for DNS (TSIG)," to send and verify signature-protected messages.

Table 6.8 Structure of TSIG Resource Record

Field | Data Type | Comment
Algorithm name | domain name | Name of the algorithm, expressed as a domain name
Time signed | u_int48_t | Seconds since 1-Jan-70 UTC
Fudge | u_int16_t | Seconds of error permitted in Time signed field
Signature size | u_int16_t | Number of octets in Signature field
Signature | octet stream | Defined by Algorithm name field
Error | u_int16_t | Expanded RCODE covering signature processing
Other len | u_int16_t | Length, in octets, of Other data field
Other data | octet stream | Undefined

Secure Dynamic Update Process

To initiate a secure dynamic update, the client first initiates the TKEY negotiation process, to determine the underlying security mechanism and to exchange keys. Next, the client sends the dynamic update request containing resource records to add, delete, or modify to the server, signed with the TSIG resource record, and the server sends an acknowledgment. Finally, the server attempts to update Active Directory on behalf of the client.

Figure 6.21 shows the dynamic update process that takes place between a Windows 2000–based client and server, if both are configured with the default settings.

Figure 6.21 Secure Dynamic Update Process

In step 1, the client queries the local name server to determine which server is authoritative for the name it is attempting to update (using the process described in "DNS Queries," found earlier in this chapter). The local name server responds with the name of the zone and the primary server that is authoritative for the zone.

In step 2, the client attempts a non-secure update, and the server refuses the non-secure update. Had the zone been configured for non-secure dynamic update rather than secure dynamic update, the server would have instead attempted to add, delete, or modify resource records in Active Directory.

In step 3, the client and server begin TKEY negotiation. First, the client and server negotiate an underlying security mechanism. Windows 2000 dynamic update clients and servers both propose the Kerberos protocol, so they decide to use it. Next, by using the security mechanism, they verify one another's identity and establish security context.

In step 4, the client sends the dynamic update request to the server, signed with the TSIG key that was generated by using the security context established in step 3. The DNS server verifies the origin of the dynamic update packet by using the security context and the TSIG key.

In step 5, the server attempts to add, delete, or modify resource records in Active Directory. Whether or not it can make the update depends on whether the client has the proper permissions to make the update and whether the prerequisites have been satisfied.

In step 6, the server sends a reply to the client stating whether or not it was able to make the update, signed with the TSIG key. If the client receives a spoofed reply, it throws it away and waits for a signed response.

Security for DHCP Clients That Do Not Support the FQDN Option

DHCP clients that do not support the FQDN option are not capable of dynamic updates. Therefore, if you want their A and PTR resource records dynamically registered in DNS, you must configure the DHCP server to perform dynamic updates on their behalf.

However, you do not want the DHCP server to perform secure dynamic updates on behalf of DHCP clients that do not support the FQDN option. If a DHCP server performs a secure dynamic update on a name, the DHCP server becomes the owner of that name, and only that DHCP server can update the name. This can cause problems in a few different circumstances. For example, suppose that the DHCP server DHCP1 created an object for the name nt4host1.reskit.com and then stopped responding, and that the backup DHCP server, DHCP2, tried to update the name; DHCP2 is not able to update the name because it does not own the name. In another example, suppose DHCP1 added an object for the name nt4host1.reskit.com, and then the administrator upgraded nt4host1.reskit.com to a Windows 2000–based computer. Because the Windows 2000–based computer did not own the name, it would not be able to update its own name.

Therefore, if you have enabled secure dynamic update, you might want to perform a special configuration for any DHCP server that will perform dynamic updates. Place the server in a special security group called DNSUpdateProxy. Objects created by members of the DNSUpdateProxy group have no security; therefore, any authenticated user can take ownership of the objects.

To add a DHCP Server to the DNSUpdateProxy group

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In the console tree, double-click the domain node.
  3. Double-click the Users folder.
  4. In the details pane, right-click the group and click Properties.
  5. Click the Members tab, then click Add.
  6. Click Look in to display a list of domains from which users and computers can be added to the group and click the domain containing the server you want to add.
  7. Click the server to be added and then click Add.

Caution

If you have installed the DHCP service on a domain controller, be absolutely certain not to make that server a member of the DNS Update Proxy group. Doing so would give any user or computer full control of the DNS records corresponding to the domain controllers, unless you manually modified the corresponding ACL. Moreover, if a DHCP server that is running on a domain controller is configured to perform dynamic updates on behalf of its clients, that DHCP server is able to take ownership of any record, even in the zones that are configured to allow only secure dynamic update. This is because a DHCP server runs under the computer account, so if it is installed on a domain controller it has full control over DNS objects stored in the Active Directory.

Windows 2000 DHCP clients register their own A resource records; therefore, putting a DHCP server in the DNSUpdateProxy group does not affect the security of the A resource records for Windows 2000 DHCP clients.

Note

The A resource record corresponding to the DHCP server has no security if the server is placed in the DNSUpdateProxy group. However, you can manually modify the ACL through the DNS console.

For more information about interaction between DNS and DHCP, see the Windows 2000 Server Help.

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Dynamic Update and Secure Dynamic Update


Winteacher.com DNS Aging and Scavenging of Stale Records Language:Farsi

2003-2005

Winteacher.com > Part2 > DNS > Aging and Scavenging of Stale Records

در Dynamic update شما ركوردهاي را بصورت خودكار در Zone هاي DNS ايجاد مي كنيد امكان دارد سيستمي كه اين ركورد را در Zone ايجاد كرده نتواند

بدرستي آن را بعد از پايان زمان TTL در DNS پاك كند اين مشكل ممكن هست در شبكه رخ دهد . واين موجب باقي ماندن اين ركورد هاي بي ارزش در DNS
مي شود . به اين ركوردهاي Stale Record گفته مي شود . منظور A , PTR Resource Record مي باشد .
وجود اين ركوردهاي بي ارزش اولا موجب گرفتن فضايي در DNS مي شوند .دوم اينكه DNS براي جواب دادن به هر query از اين ركوردها نيز استفاده مي كند كه
اين خود موجب بالا رفتن بار كاري و پايين آمدن سرعت جواب دهي DNS به Client ها مي شود .

Dnscmd.exe

Aging and Scavenging Parameters

در جدول زير مي توان Parameter هاي موجود در Zone ها را و چگونگي كار آنها را مشاهده كرد .

Table 6.9 Aging and Scavenging Parameters for Zones

Zone Parameter | Description | Configuration Tool | Notes
No-refresh interval | Time during which the server does not accept refreshes for the record. (The server still accepts updates.) This value is the interval between the last time a record was refreshed and the earliest moment it can be refreshed again. | DNS console and Dnscmd.exe | When an Active Directory–integrated zone is created, this parameter is set to the DNS server parameter Default no-refresh interval. This parameter replicates through Active Directory replication.
Refresh interval | The refresh interval comes after the no-refresh interval. At the beginning of the refresh interval, the server begins accepting refreshes. After the refresh interval expires, the DNS server can scavenge records that have not been refreshed during or after the refresh interval. | DNS console and Dnscmd.exe | When an Active Directory–integrated zone is created, this parameter is set to the DNS server parameter Default refresh interval. This parameter is replicated by Active Directory.
Enable Scavenging | This flag indicates whether aging and scavenging is enabled for the records in the zone. | DNS console and Dnscmd.exe | When an Active Directory–integrated zone is created, this parameter is set to the DNS server parameter Default enable scavenging. This parameter is replicated by Active Directory.
ScavengingServers | This parameter determines which servers can scavenge records in this zone. | Only Dnscmd.exe | This parameter is replicated by Active Directory.
Start scavenging | This parameter determines when a server can start scavenging of this zone. | Not configurable | This parameter is not replicated by Active Directory.

در جدول زير پارامترهاي سرور در زمان راه اندازي Aging AND Scavenging را مشاهده مي كنيد .

Table 6.10 Aging and Scavenging Parameters for Servers

Server Parameter | Description | Configuration Tool | Notes
Default no-refresh interval | This value specifies the no-refresh interval that is used by default for the Active Directory–integrated zone. | DNS console (shown as No-refresh interval) and Dnscmd.exe | By default, this is 7 days.
Default refresh interval | This value specifies the refresh interval that is used by default for the Active Directory–integrated zone. | DNS console (shown as Refresh interval) and Dnscmd.exe | By default, this is 7 days.
Default Enable Scavenging | This value specifies the Enable Scavenging parameter that is used by default for the Active Directory–integrated zone. | DNS console (shown as Enable scavenging)and Dnscmd.exe | By default, scavenging is disabled.
Enable scavenging | This flag specifies whether the DNS server can perform scavenging of stale records. If scavenging is enabled on a server, it automatically repeats scavenging as often as specified in the Scavenging Period parameter. | DNS console, Advanced View (shown as Enable automatic scavenging of stale records) and Dnscmd.exe | By default, scavenging is disabled.
Scavenging Period | This period specifies how often a DNS server enabled for scavenging can remove stale records. | DNS console, Advanced View (shown as Scavenging Period) and Dnscmd.exe | By default, this is 7 days.

Configuring Scavenging Parameters

اما براي راه اندازي يا در واقع پاك سازي سرور يا Zone هاي DNS از اين ركورد ها بايد مراحل زير را انجام داد .لازم بذكر مي باشد كه اين عمل را مي توان در
مدت زمان مشخص بصورت دوره اي انجام داد كه Default اين زمان 7 روز مي باشد .

براي اين كار شما بر روي Zone در DNS Console بايد Right Click كنيد و Properties را انتخاب كنيد و در Tab General گزينه Aging را انتخاب

كنيد

پس از انتخاب اين گزينه منوي زير باز مي شود و شما بايد مدت زمان مورد نظر خود را تعريف كنيد.

Scavenge stale resource records
اين گزينه بايد فعال شود تا در مدت زمان تعريف شده سيستم ركوردهاي خراب و بي ارزش را از Zone پاك كند .

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

Winteacher.com > Part2 > DNS > Aging and Scavenging of Stale Records


Winteacher.com DNS Integration with WINS

2003-2005

> Part2 > DNS > Integration with WINS

در Windows NT 4 در سرویس DNS گزینه ای بنام Wins Lookup وجود دارد که این امکان را می دهد Client ها بتوانند از WINS نیز برای

عمل Name Resolution استفاده کنند .

زمانی که یک Client به DNS یک query بفرستد که DNS نتواند به آن جواب دهد از Database موجود در WINS استفاده می کند . برای جواب

دادن به query . البته این امکان در Windows 2000 Server نیز پشتیبانی می شود

Figure 6.23 Example of WINS Lookup

در شکل بالا می بینید که DNS Client برای بدست آوردن یک Netbios name و IP Address از یک Wins Server کمک گرفته بواسطه

DNS Server های موجود .

در شکل بالا client یک DNS Clients می باشد و آدرس Wins Server را در اختیار ندارد تا مستقیما query را به آن بفرستد .

Configuring WINS Lookup

یرای فعال کردن این گزینه باید مراحل زیر را انجام داد و IP Address سرور WINS را به WINS Lookup داد .

To configure WINS lookup

  1. In the DNS console, right-click the zone for which you are enabling WINS lookup, and then click Properties.
  2. In the Properties dialog box for the zone, click the WINS tab.
  3. Select the Use WINS forward lookup check box.
  4. Under IP address, type the WINS Server IP address that will be used for resolution, and then click Add.

Advanced Parameters for WINS Lookups

در این قسمت می تواند مقدار زمان Cache کردن جوابهایی که به query ها داده می شود و نیز مدت زمانی که سرور DNS صبر می کند تا اگر جواب

از WINS Server نگرفت به دنبال WINS Server دومی برود را تغییر داد .

Cache Time-out Indicates to a DNS server how long to cache any of the information returned in a WINS lookup. By default, this value is set to 15 minutes.

Lookup Time-out Specifies how long to wait for a response from a WINS server before timing out and querying the next WINS server specified in a WINS record. By default, this value is 2 seconds.

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Integration with WINS


Winteacher.com DNS Internet Access Considerations

2003-2005

> Part2 > DNS > Internet Access Considerations

برای اینکه شبکه شما در Internet برای افراد دیگر قابل دسترسی باشد شما باید یک P ublic namespace در Internet داشته باشید .

زمانی که شما از Internal Namespace در شبکه Local و نیز (Public Namespace) یا همان External Namespace در

Internet می خواهید استفاده کنید . برای این کار شما باید DNS Server را برای جوابگویی به Internal query و External query آماده کنید .

در واقع DNS server شما باید به Internal Client سرویس Locally را بدهد ونیز سرویس برای Resolve کردن

External Namespace را نیز بدهد .

Planning Your Namespace

معمولا در شبکه های اداری و کوچک شما کلیه query های مربوط به Internet را به DNS Server های شبکه اینترنت Forward می کنید

و این کار بهتر می باشد چون عمل Name Resolution را به سرورهای بزرگ Internet اختصاص می دهید .

You can use a private root only if each of your clients has one of the following:

  • name exclusion list. A list of DNS suffixes that are internal.
  • proxy autoconfiguration (PAC) file. A list of DNS suffixes and exact names that are internal or external.

If you have clients lacking both of these, the DNS server hosting your organization's top-level internal domain must forward queries to the Internet.

Table 6.12 Configuring Internal and External Namespaces Based on Proxy Capability

No Proxy Local Address Table (LAT) Name Exclusion List Proxy Auto-configuration (PAC) File
Microsoft software with corresponding proxy capability

Generic Telnet

Windows Sockets Proxy (WSP) 1.x, WSP 2.x

WSP 1.x, WSP 2.x, and all versions of Microsoft® Internet Explorer.

WSP 2.x, Internet Explorer 3.01 and later.

Can you forward queries?

Must forward queries.

Must forward queries.

Possible.

Possible.

Can you use a private root?

Not possible. Not possible. Possible. Possible.

Note: that a local address table is a list of IP addresses that are internal and external.

در جدول بالا مشاهده می کنید که کدام محصول با کدام Proxyمی تواند query را به شبکه اینترنت Forward کند.و نیز آیا می توانPrivate Root DNS

در شبکه Local داشت یاخیر .

Example of Queries

Namespace Planning Example

Query for a Name in the Internal Namespace

Query for a Name in the External Namespace

Query for a Name in the External Namespace of an Organization

Query for a Name in the Namespace of the Merged Organization

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Internet Access Considerations


Winteacher.com DNS Namespace Planning Example( Language: English)

DNS Domain Name Service

2003-2005

> Part2 > DNS > Namespace Planning Example

The following sections explain some of the issues you must consider when planning your namespace by describing the configuration of two fictitious organizations. The first organization, which has reserved the DNS domain names reskit.com and reskit01-ext.com, has only proxy clients that support either exclusion lists or PACs. In contrast, the second organization, which has reserved the DNS domain names acquired01-int.com and acquired01-ext.com, has no such proxy clients. Both organizations use a different domain name for their internal and external namespaces.

Reskit.com and acquired01-int.com both need a configuration that does the following:
  • Exposes only the public part of the organization's namespace to the Internet.
  • Enables any computer within the organization to resolve any internal or external name.
  • Enables any computer within the organization to resolve any name from the Internet.

Moreover, both organizations have merged, and every computer from within each private namespaces must be able to resolve any name from the other namespace.

The following sections describe how both organizations have configured their external and internal namespaces to satisfy these requirements. Figure 6.27 shows this configuration.

Figure 6.27 Example Configuration of the DNS Domains Reskit.com and Acquired01-int.com

Configuring the External Namespace
In the external namespace, two zones exist: reskit01-ext.com and acquired01-ext.com. The zones contain only the records (the names and delegations) that the companies want to expose to the outside world. The server server.reskit01-ext.com. hosts the zone reskit01-ext.com, and the server server.acquired01-ext.com hosts the zone acquired01-ext.com. The names reskit01-ext.com and acquired01-ext.com must be registered with an Internet name authority.
Configuring the Internal Namespace
The internal namespace for the organization that hosts reskit01-ext.com externally is reskit.com. Similarly, the internal namespace for the organization that hosts acquired01-ext.com externally is acquired01-int.com. The server server.reskit.com hosts the zone reskit.com, and the server server.acquired01-int.com hosts the zone acquired01-int.com. The names reskit.com and acquired01-int.com must be registered with an Internet name authority.

All the computers in reskit.com support either exclusion lists or PACs, and none of the computers in acquired01-int.com support either exclusion lists or PACs.

Namespace Without Proxy Clients That Support Exclusion Lists or PACs
For a namespace in which none of the computers are proxy clients that support either exclusion lists or PACs (in this example, the namespace of acquired01-int.com), an organization must devote one or more DNS servers to maintain zones that contain all names from the internal namespace. Every DNS client must send DNS queries to one or more of these DNS servers. If a DNS server contains the zone for the top level of the organization's namespace (for example, acquired01-int.com), then it must forward those queries through a firewall to one or more DNS servers in the Internet namespace. All other DNS servers must forward queries to one or more DNS servers that contain the zone for the top level of the organization's namespace.

To make sure that any client within the organization can resolve any name from the merged organization, every DNS server containing the zone for the top level of the organization's namespace must also contain the zones that include all the internal and external names of the merged organization.

This solution places a significant load on the internal DNS servers that contain the organization's internal top-level zones. Most of the queries generated within the organization are forwarded to these servers, including queries for computers in the external namespace and in the merged organization's private namespace. Also, the servers must contain secondary copies of the merged organization's zones.

Namespace with Proxy Clients That Support Exclusion Lists or PACs
For a namespace in which all of the computers are proxy clients that support either exclusion lists or PACs (for example, the namespace of reskit.com), the private namespace can include a private root. In the internal namespace, there can be one or more root servers, and all other DNS servers must include the name and IP address of a root server in their root hints files.

To resolve internal and external names, every DNS client must submit all queries to either the internal DNS servers or to a proxy server, based on an exclusion list or PAC file.

To make sure that every client within the organization can resolve every name from the merged organization, the private root zone must contain a delegation to the zone for the top level of the merged organization.

Using proxy clients and a private root simplifies DNS configuration because none of the DNS servers need to include a secondary copy of the zone. However, this configuration requires you to create and manage exclusion lists or PAC files, which must be added to every proxy client in the network.

DNS Domain Name Service

LastUpdate:2005/04/05

> Part2 > DNS > Namespace Planning Example


Winteacher.com DNS Example of Queries (Query for a Name in the Internal Namespace)

2003-2005

> Part2 > DNS > Example of Queries (Query for a Name in the Internal Namespace)

در شکل زیر یک مثال از query درون Reskit.com چگونگی مراحل آن را مشاهده می کنید . Acquired01-int.com شبکه Lan دیگر

می باشد ارتباط بین این دو LAN توسط VPN Server ها می باشد .در Reskit.com یک Private Root DNS وجود دارد ولی در

Acquired01-int.com این نوع یعنی Top-level Domain وجود ندارد .

در Domain Acquired01-int.com یک Secondary Zone وجود دارد که Acquired01-int.com نام دارد و بدلیل

M ultimaster Replication می توان Reskit.com را در این Domain داشت .

Figure 6.28 Query for an Internal Name in the Domain Reskit.com

The query proceeds as follows:
  1. The computer submits a query to its local DNS server, server.first.reskit.com.
  2. If the local server is not authoritative for host.second.reskit.com, the local DNS server queries a root server.
  3. The root server returns a reference to the authoritative server, server.second.reskit.com.
  4. The local server, server first.reskit.com, queries server.second.reskit.com.
  5. Server.second.reskit.com resolves the query and returns the response to the local server.
  6. Server.first.reskit.com passes the response to the client.

Example of Queries (Query for a Name in the Internal Namespace)

Query for an Internal Name in the Domain Acquired01-int.com

در Domain Acquired01-int.com بر خلاف بالا query بعد عبور از Local DNS server به root DNS نمی رود بلکه

Forward می شود به سرور دیگری .

Figure 6.29 Query for an Internal Name in the Domain Acquired01-int.com

The query proceeds as follows:
  1. The computer submits the query to its local DNS server, server.first.acquired01-int.com.
  2. If the local server is not authoritative for host.second.acquired01-int.com, the local DNS server forwards the query to the DNS server that is authoritative for the acquired01-int.com zone.
  3. The DNS server that is authoritative for the acquired01-int.com zone finds a delegation to the server server.second.acquired01-int.com and queries that server.
  4. Server.second.acquired01-int.com resolves the query and returns the name to the DNS server authoritative for the acquired01-int.com zone.
  5. The DNS server that is authoritative for the acquired01-int.com zone returns the name to the local DNS server.
  6. Server.first.acquired01-int.com returns the name to the client.

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Example of Queries (Query for a Name in the Internal Namespace)


Winteacher.com DNS Example of Queries (Query for a Name in the External Namespace)

2003-2005

> Part2 > DNS > Example of Queries (Query for a Name in the External Namespace)

در شکل زیر مشاهده می کنید که Client برای شروع query خود را به Proxy serv می فرستد چون آن یک Proxy Client می باشد

برای شروع از طریق PAC Files متوجه می شود که Namespace مورد نظر Internal Namespace نمی باشد پس Query بطرف

Internal DNS Server ها نمی رود. در مرحله بعد این Query بطرف آن Public (External) DNS Server می رود

که در Internet آماده شده برای دریافت Query از Reskit.com که نام آن سرور Server.reskit01-ext.com می باشد سپس این Query

برای پیدا کردن Host.isp01-ext.com از طریق سرورهای Public root DNS به سرور DNS با نام Server2.isp01-ext.com فرستاده

می شود تا از آن جواب بگیرد در مورد IP Address سیستمی بانام Host و DNS Suffix بنام ISP01-EXT.COM و الی آخر .

(PAC) file
Note: proxy autoconfiguration (PAC) file. A list of DNS suffixes and exact names that are internal or external.

Figure 6.30 Query in the Domain Reskit.com for a Name on the Internet
The query proceeds as follows:
  1. Because the client is a proxy client, it consults its exclusion list or its PAC file and determines that the name is not in the internal namespace. Therefore, the client sends the request to the proxy server.
  2. The proxy server sends a query to the DNS server to which it is configured to send queries. In this case, the server is server.reskit01-ext.com.
  3. The server server.reskit01-ext.com sends a query to the Internet root server.
  4. The Internet root server returns a referral to a server that is authoritative for the Internet zone com.
  5. The server server.reskit01-ext.com queries the server that is authoritative for the com zone.
  6. The server that is authoritative for the zone com returns a referral to the server that is authoritative for the zone isp01-ext.com.
  7. The server server.reskit01-ext.com queries the server that is authoritative for the zone isp01-ext.com.
  8. The server that is authoritative for the zone isp01-ext.com returns the IP address that corresponds to the name host.isp01-ext.com.
  9. The server server.reskit01-ext.com returns the response to the proxy server.
  10. The proxy server uses the IP address to contact host.isp01-ext.com and provides necessary information to the client.

Example of Queries (Query for a Name in the External Namespace)

Query in the Domain Acquired01-int.com for a Name on the Internet
اما در Acquired01-int.com سرور Proxy وجود ندارد .پس Client یک Query به Local DNS Server خود می فرستد .وقتی سرور
First.Acquired01-int.com در Cache خود جوابی برای آن پیدا نکند این Query را به سرور Parent خود Acquired01.int.com
می فرستد یا در واقع Forward می کند .و آن نیز این Query را بدلیل اینکه در مربوط به Internet می باشد از طریق Firewall به سرور مربوطه بنام
Acquired01-ext.com موجود در Internet می فرستد و آن نیز به Public Root DNS Server می فرستد و الی آخر .
در اینجا نیز مانند مثال بالا Client بدنبال سیستمی بانام Host.isp01-ext.com در Internet می باشد .
Figure 6.31 Query in the Domain Acquired01-int.com for a Name on the Internet
The query proceeds as follows:
  1. The computer queries its local DNS server, server.first.acquired01-int.com.
  2. If the server cache does not contain the requested data, the local DNS server forwards the query to the DNS server that is authoritative for the zone acquired01-int.com, server.acquired01-int.com.
  3. The server server.acquired01-int.com forwards the query to the external server, server.acquired01-ext.com, through the firewall.
  4. The server server.acquired01-ext.com sends a query to the Internet root server.
  5. The Internet root server returns a referral to a server that is authoritative for the Internet zone com.
  6. The server server.acquired01-ext.com queries the server that is authoritative for the zone com.
  7. The server that is authoritative for the zone com returns a referral to the server that is authoritative for the zone isp01-ext.com.
  8. The server server.acquired01-ext.com queries the server that is authoritative for the zone isp01-ext.com.
  9. The server that is authoritative for the zone isp01-ext.com returns the IP address that corresponds to the name host.isp01-ext.com.
  10. The server server.acquired01-ext.com returns the IP address to server.acquired01-int.com through the firewall.
  11. Server.acquired01-int.com returns the IP address to the local DNS server, server.first.acquired01-int.com.
  12. Server.first.acquired01-int.com returns the IP address to the client. The client can then contact the host through the firewall and download the desired Web page.

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Example of Queries (Query for a Name in the External Namespace)


Winteacher.com DNS Examples of Queries (Query for a Name in the External Namespace of an Organization)

2003-2005

> Part2 > DNS > Query for a Name in the Namespace of the Merged Organization

در شکل زیر Proxy Client از طریق PAC file متوجه می شود که برای دسترسی به آدرس Host.Acquired01-int.com باید Query را

برای Local DNS Server خود بنام Server.first.reskit.com ارسال کند . اگر در Cache خود سرور DNS نتواند آدرس را پیدا کند

Query را برای Private root DNS خود ارسال می کند . در آنجا یک Delegation به Zone Acquired01-int.com دیده می شود .

آدرس مربوط به آن Zone و سرور آن به Server.first.reskit.com داده می شود و آن Query را به شبکه Remote می فرستد توسط VPN

سرور های موجود و جواب را از سرور DNS در شبکه Remote دریافت می کند.

در اینجا نیز Proxy client بدنبال آدرس سیستم Host.Acquired01-int.com می باشد .

Figure 6.34 Query for a Name in the Acquired01-int.com Namespace
The query proceeds as follows:

  1. Because the computer is a proxy client, it consults its exclusion list or its PAC file and submits a query for the name host.acquired01-int.com to the local DNS server, server.first.reskit.com.

  2. If the cache does not contain the necessary data, the server queries the internal root server.
  3. The root server finds a delegation to the zone acquired01-int.com and returns the IP address of the server that is authoritative for acquired01-int.com to the local DNS server.
  4. The local DNS server submits the query to the server that is authoritative for acquired01-int.com.
  5. Because that server is authoritative for host.acquired01-int.com, the server resolves the query and returns the answer to the local DNS server.
  6. Server.first.reskit.com returns the response to the client.

Example of Queries (Query for a Name in the Namespace of the Merged Organization)

Query for a Name in the Reskit.com Namespace

در زیر مشاهده می کنید که Client برای بدست آوردن IP Address یک سیستم در شبکه Remote نیازی به ارسال Query به آن شبکه را ندارد

چون یک Secondary Zone از Reskit.com در خود دارد . وقتی DNS Client یک Query به Local DNS server خود ارسال می کند

اگر در Cache آن سرور چواب وچود نداشت سرور DNS آن Query را Forward می کند یه Server.acquired01-int.com و چون یک

Secondary Zone در آنجا از شبکه Remote وجود دارد IP Address را پیدا کرده و به سرور First.acquired01-int.com ارسال

می کند و آن نیز جواب را به DNS Client می دهد .

Figure 6.35 Query for a Name in the Reskit.com Namespace
The query proceeds as follows:
  1. The computer submits a query to its local DNS server, server.first.acquired01-int.com.
  2. If the cache does not contain the necessary data, the server forwards the query to the DNS server that is authoritative for the zone acquired01-int.com.
  3. Because the DNS server that is authoritative for the zone acquired01-int.com contains a secondary copy of the zone reskit.com, it resolves the query and returns the response to server.first.acquired01-int.com.
  4. Server.first.acquired01-int.com returns the response to the client.

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Query for a Name in the Namespace of the Merged Organization


Winteacher.com DNS To add a host (A) resource record to a zone. Language Farsi

2003-2005

Winteacher.com > Part2 > DNS > To add a host (A) resource record to a zone.

برای اضافه کردن یک A Resource Record باید مراحل زیر را انجام داد .گزینه 5 زمانی می توان استفاده کرد .که از PTR رکورد در شبکه استفاده

می شود در Domain فردی که عضو گروه Domain Admins باشد می تواند این رکورد را ایجاد کند در DNS و یا Edit کند .

  1. To open DNS, click Start, point to Settings, click Control Panel, double-click Administrative Tools, and then double-click DNS.
  2. In the console tree, right-click the applicable forward lookup zone and click New Host.
  3. In the Name text box, type the DNS computer name for the new host.
  4. In the IP address text box, type the IP address for the new host.
  5. As an option, select the Create associated pointer (PTR) record check box to create an additional pointer record in a reverse zone for this host, based on the information you entered in Name and IP address.
  6. Click Add Host to add the new host record to the zone.

Host1 IN A 192.168.1.254

در A Record بالا سیستمی با نام Host1 وجود دارد که IP 192.168.1.254 به آن داده شده .

Name-to-IP Address Mappings

Using a Command Line (DNSCMD.exe)

راه دوم برای اضافه کردن یک رکورد در DNS استفاده از Dnscmd.exe می باشد . قبل از استفاده باید Windows Support tools را نصب

کرد . سپس از این Command استفاده کرد .

  1. First Iinstall Windows Support Tools then Open Command Prompt.
  2. Type: dnscmd ServerName /RecordAdd ZoneName NodeName [/Aging] [/OpenAcl] [Ttl] A IPAddress
Value | Description
dnscmd | Specifies the name of the command-line program.
ServerName | Required. Specifies the DNS host name of the DNS server. You can also type the IP address of the DNS server. To specify the DNS server on the local computer, you can also type a period (.).
/RecordAdd | Required. Adds a new resource record.
ZoneName | Required. Specifies the fully qualified domain name (FQDN) of the zone.
NodeName | Required. Specifies the FQDN of the node in the DNS namespace. You can also type the node name relative to the ZoneName or @, which specifies the zone's root node.
/Aging | Specifies that this resource record is able to be aged and scavenged. If this command is not used, the resource record remains in the DNS database unless it is manually updated or removed.
/OpenAcl | Specifies that new records are open to modification by any user. Without this parameter, only administrators may modify the new record.
Ttl | Specifies the Time-To-Live (TTL) setting for the resource record. (The default TTL is defined in SOA resource record).
A | Required. Specifies the resource record type of the record you are adding.
IPAddress | Required. The IP address for the host.
  • To view the complete syntax for this command, at a command prompt, type:

    dnscmd /RecordAdd /help

  • PTR resource records are deleted automatically if the corresponding A resource record is deleted.

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

Winteacher.com > Part2 > DNS > To add a host (A) resource record to a zone.


Winteacher.com DNS To add a pointer (PTR) resource record to a reverse zone. Language:Farsi

2003-2005

> Part2 > DNS > To add a pointer (PTR) resource record to a reverse zone

برای اضافه کردن یک PTR Resource Record باید مراحل زیر را انجام داد .

  1. To open DNS, click Start, point to Settings, click Control Panel, double-click Administrative Tools, and then double-click DNS.
  2. In the console tree, right-click the applicable reverse lookup zone.
  3. On the Action menu, click New Pointer.
  4. In the Host IP number text box, type the host IP address octet number.
  5. In the Host name text box, type the fully qualified domain name for the DNS host computer for which this pointer record is to be used to provide reverse lookup (address-to-name resolution).

    As an option, you can click Browse to search the DNS namespace for hosts in this domain that have host (A) records already defined.

  6. Click OK to add the new record to the zone.

1.48.16.172.in-addr.arpa. IN PTR noamdc1.noam.reskit.com.

در PTR Record بالا سیستمی با IP Address 172.16.48.1 وجود دارد که به Noamdc1.noam.reskit.com ربط داده شده .

IP address–to–host mappings

Using a Command Line (DNSCMD.exe)

می توان از دستور Dnscmd.exe نیز استفاده کرد .

  1. First Iinstall Windows Support Tools then Open Command Prompt.
  2. Type: dnscmd ServerName /RecordAdd ZoneName NodeName [/Aging] [/OpenAcl] [Ttl] PTR HostName|DomainName

Value | Description
dnscmd | Specifies the name of the command-line tool.
ServerName | Required. Specifies the DNS host name of the DNS server. You can also type the IP address of the DNS server. To specify the DNS server on the local computer, you can also type a period (.).
/RecordAdd | Required. Adds a new resource record.
ZoneName | Required. Specifies the fully qualified domain name (FQDN) of the zone.
NodeName | Required. Specifies the FQDN of the node in the DNS namespace. You can also type the node name relative to the ZoneName or @, which specifies the zone's root node.
/Aging | Specifies that this resource record is able to be aged and scavenged. If this command is used, this resource record is able to be aged and scavenged. If this command is not used, the resource record remains in the DNS database unless it is manually updated or removed.
/OpenAcl | Specifies that new records are open to modification by any user. Without this parameter, only administrators may modify the new record.
Ttl | Specifies the Time-To-Live setting for the resource record.
PTR | Required. Specifies the resource record type.
HostName|DomainName | Required. Specifies the FQDN of a resource record located in the DNS namespace. The host you specify is used as the data for answering reverse lookups based on the address information specified by this pointer (PTR) resource record.
  • To view the complete syntax for this command, at a command prompt, type:

    dnscmd /RecordAdd /help

  • PTR resource records are deleted automatically if the corresponding A resource record is deleted.

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > To add a pointer (PTR) resource record to a reverse zone


Winteacher.com DNS To add a CNAME Resource Records to a zone.

2003-2005

> Part2 > DNS > To add an alias (CNAME) resource record to a zone

از این نوع رکورد برای مخفی نکه نداشتن آدرس برخی ار سرور ها استفاده می شود .

در قسمت Alias Name نام مجازی را مشخص کرده و در قشمت FQDN for Target Host شما نام یا A Resource Record

خود را که می خواهید نامش به Alias Name که معرفی کردید شناسایی شود را معرفی می کنید .

برای این کار شما باید اول بر روی Zone مورد نظر خود رفته سپس مراحل زیر را انجام دهید .

در واقع استفاده ای که از این رکورد می توان کرد این می باشد اگر شما بخواهید دو نام به یک سرور بدهید مانند WWW و FTP می توان از این رکورد استفاده

کرد . در Internet می توان اگز زمانی نام سرور خود را که ftp بوده به FTPServ تغییر داده اید برای اینکه افراد درون Internet
مشکلی برایشان رخ ندهد باید یک CNAME از FTPServ بنام FTP درست کنید .

FTPServ IN A 200.10.32.56

FTP IN CNAME FTPServ

  1. Open DNS.
  2. In the console tree, right-click the applicable forward lookup zone, and then click New Alias.
  3. In the Alias name text box, type the alias name.
  4. In the Fully qualified domain name (FQDN) for target host text box, type the fully qualified domain name of the DNS host computer for which this alias is to be used.

    As an option, you can click Browse to search the DNS namespace for hosts in this domain that have host (A) records already defined.

  5. Click OK to add the new record to the zone

بعد ساختن این رکورد در Zone مورد نظر DNS Server به Request مربوط به DC1 آدرس سیستم Client1-xp.D-net.Enterprise.com

را می دهد .

Client1-xp IN A 192.168.1.150

DC1 IN CNAME Client1-xp

در بالا DC1 نام می باشد که به Client1-xp داده شده .توسط دسنور Ping می توانید این مورد را Test کنید .

توسط دستور Nslookup.exe نیز می توان این مورد را چک کرد .

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > To add an alias (CNAME) resource record to a zone


Winteacher.com DNS Properties Interfaces Tab

2003-2005

> Part2 > DNS > DNS Console Properties For DNS SERVER - Interfaces Tab

در این قسمت شما باید لیستی از IP Address های سرور را مشخص کنید که سرویس بر روی آنها می تواند فعالیت داشته باشد .

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > DNS Console Properties For DNS SERVER - Interfaces Tab


Winteacher.com DNS Properties RoothintsTab

2003-2005

> Part2 > DNS > DNS Console Properties For DNS SERVER - Root Hints Tab

Root Hints

برای اینکه یک سرور بتواند به سرور های بالایی خود دسترسی داشته باشد از این گزینه استفاده می شود بعنوان مثال ( Preferred DNS Server) برای

اینکه Request را به (Example) که در Microsoft.com وجود دار بفرستدد باید برای فرستادن به higher-level domain

خود به Root Server خود مراجعه می کند و از آنجا Request به سرور دارای Zone COM می فرستد و سپس به Zone MICROSOFT می رسد

که دارای یک Zone بنام Example می باشد این مراحل موجب می شود که سرور Preferred DNS بتواند آدرس سرور موجود در این Zone بنام

Example را برای Clients خود برساند.

بدلیل اینکه سرور های ROOT در Internet دارای ترافیک بالایی هستند می توان از گزینه Forward برای فرستادن Request به یک

DNS Server مورد نظر در Internet فرستاد مانند Sun.

Copy from server

برای UPDATE کردن لیست Root Hints می توان در قسمت زیر IP Address سرورهای دیگر را که Root Hints انها را نیاز دارید Add کرد .

To update root hints on the DNS server

  1. Open DNS.
  2. In the console tree, click the applicable DNS server.

    Where?

    • DNS
    • applicable DNS server
  3. On the Action menu, click Properties.
  4. Click the Root Hints tab.
  5. Modify server root hints as follows:
    • To add a root server to the list, click Add, and then specify the name and IP address of the server to be added to the list.
    • To modify a root server in the list, click Edit, and then specify the name and IP address of the server to be modified in the list.
    • To remove a root server from the list, select it in the list, and then click Remove.
    • To copy root hints from a DNS server, click Copy from server, and then specify the IP address of the DNS server from which you want to copy a list of root servers to use in resolving queries. These root hints will not overwrite any existing root hints.

در شکل زیر می توان استفاده مناسب از List Root Hints را مشاهده کرد

زمانی که یک DNS Client یک External query را به Local DNS Serv خود ارسال کند در مرحله اول DNS Servبدنبال جواب در Cache

خود و Zone های خود می گردد اگر جوابی نگرفت query را به سرورهای موجود در Forwarders List خود ارسال می کند .در اینجا سرور DNS

با IP Address 10.0.0.1 از طریق Private-i خود query را در یافت می کند و از طریق Public-i خود query را به Root Server های

موجود در لیست Root Hints خود ارسال می کنند این سرورها در Internet می باشند این مراحل در شکل زیر مشخص می باشد.

در شکل زیر DNS Server 10.0.0.1 دارای امنیت زیادی نیست پس وجود Firewall در LAN و یک Device مانند ROUTER یا

Internet gateway بین Internet و DNS Serv لازم می باشد.اما بهترین راه برای امنیت شبکه استفاده از ترافیک IPSec در LAN می باشد

این بستگی به سیاست ADMIN شبکه دارد که از کدام راه برای امنیت شبکه استفاده کند.

  1. When the DNS server receives a query, it attempts to resolve this query using the primary and secondary zones that it hosts and its cache.
  2. If the query cannot be resolved using this local data, then it will forward the query to the DNS server designated as a forwarder.
  3. The DNS server will wait briefly for an answer from the forwarder before attempting to contact the DNS servers specified in its root hints.

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > DNS Console Properties For DNS SERVER - Root Hints Tab


Winteacher.com DNS Properties Advanced Tab

2003-2005

> Part2 > DNS > DNS Console Properties For DNS SERVER - Advanced Tab

Enable Round robin

زمانی که یک سیستم دارای چند IP Address باشد برای بالا بردن سرعت و کم کردن از Traffic Network آن می توان از این گزینه بر روی سرور

استفاده کرد

در شکل بالا هر User برای دیدن (www.iis.com) به یکی از سه IP Address این Site رجوع می کند .

برای اطلاعات بیشتر به صفحه Windows Resolver رجوع کنید .
Fail on load if bad zone data

در زمان Load کردن یک Zone از هر نوعی اگر Error رخ دهد از Load شدن آن بر روی سرور DNS جلوگیری می کند .

Enable netmask ordering

نزدیکترین IP Address یک Multihomed را به DNSClient بر می گرداند اگر یک سیستم Multihome دارای سه IP زیر باشد

سرویس DNS به سیستم DNSClient که دارای IP در Class A باشد IP Address 10.0.0.14 را بر می گرداند . در واقع IP هم کلاس

DNSClient اگر باشد را بر می گرداند

multihomed IN A 192.168.1.27
multihomed IN A 10.0.0.14
multihomed IN A 172.16.20.4

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > DNS Console Properties For DNS SERVER - Advanced Tab


Winteacher.com DNS Properties Forwarders Tab

2003-2005

> Part2 > DNS > DNS Console Properties For DNS SERVER - Forwarders Tab

زمانی که سرور به یک query نتواند جواب دهد .می توان این Query را به یک DNS Server دیگر که از نظر سرور معتبر می باشد فرستاد .

یا Forward کرد . در این قسمت IP Address سرور های DNS مورد نظزر خود را باید اضافه کرد .

در شکل زیر User برای بدست آوردن IP Address سیستم Client 1 از Local DNS Server خود در خواست دادن IP Address را کرده

چون Local DNS Server در Zone خود و Cache خود جوابی برای این query ندارد آن را Forward می کند به سرور های درون

Forward IP Address List خود تا جوابی برای User پیدا کند .

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > DNS Console Properties For DNS SERVER - Forwarders Tab


Winteacher.com DNS Properties-GeneralTab-ADSIntegrated Zone

2003-2005

> Part2 > DNS > DNS Console Properties For Active Directory Integrated Zone - General Tab

در این قسمت می توان وضعیت یک Zone و نوع آن را مشاهده کرد ودر صورت لزوم آن را تغییر داد .

Dynamic Updates

برای اطلاعات بیشتر به قسمت Dynamic Update and Secure Dynamic Update مراحعه کنید لازم بذکر می باشد فقط در

Zone های که از نوع Active Directory Integrated Zone می باشند می توان نوع Secure only را فعال کرد .

Aging

به قسمت Aging and Scavenging of Stale Records مراجعه کنید

Change Type Zone

برای تغییر دادن نوع یک Zone باید Click کنید بر روی گزینه Change در قسمت Type سپس منو زیر باز می شود و نوع مورد نظر را انتخاب می کنید .

برای اطلاعات بیشتر به صفحه Active Directory Integration and Multimaster Replication مراجعه کنید

Store the zone in Active Directory (Available only if DNS server is a Domain Controller)

زمانی که این گزینه فعال باشد Zone شما از نوع Active Directory Integrated می باشد .

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > DNS Console Properties For Active Directory Integrated Zone - General Tab


Winteacher DNS Properties-WinsTab-ADSIntegrated Zone

2003-2005

> Part2 > DNS > Properties For Active Directory Integrated Zone - WINS Tab

(Forward Lookup Zone)

برای استفاده از گزینه Wins Lookup در قسمت IP Address باید IP های سرورهای WINS در شبکه را وارد کنید .

برای اطلاعات بیشتر به صفحه Integration with WINS مراجعه کنید .

WINS Lookup in WINDOWS 2003 Server

در Windows 2000 Server این منو کمی متفاوت می باشد.

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Properties For Active Directory Integrated Zone - WINS Tab


Winteacher.com DNS Properties-Name ServersTab-ADSIntegrated Zone

2003-2005

> Part2 > DNS > Properties For Active Directory Integrated Zone - Name Servers Tab

در این قسمت برای هر Zone می توان مشخص کرد که کدام سرور DNS در شبکه Secondary Server این Zone می باشند . یا در

واقع یک Zone از نوع Secondary از Zone شما را در خود دارد . با این کار شما به Zone خود می گویید که زمانی

اگر سرور Secondary بخواهد Primary Zone خود را Update کند آیا می تواند یاخیر باید IP Address آن در این قسمت

باشد .در زمان Zone Transfer نیز فقط با این سرور ها Zone Transfer Traffic ایجاد می شود .این کار یک جور محدود کردن این

Traffic می باشد .لازم بذکر است که این گزینه در Zone های Active Directory Integrated فعالیت نمی کند بنا به خاصیت

MultiMaster Replication که در آن وجود دارد پس فقط در Zone های معمولی استفاده دارد . بصورت Default همیشه سرور

همیشه سرور DNS به authoritative DNS شبکه خود اجازه Zone Transfer می دهد . که در این Tab معرفی شده.

در زیر مراحل انجام شدن این Zone Transfer و نقش این IP Address ها را که در این قسمت معرفی می کنیم را بهتر می توان درک کرد .

The following is a brief summary of the typical DNS notification process for zone updates:
  1. The local zone at a DNS server acting as a master server, a source for the zone to other servers, is updated. When the zone is updated at the master or source server, the serial number field in the SOA RR is also updated, indicating a new local version of the zone.
  2. The master server sends a DNS notify message to other servers that are part of its configured notify list (Name Servers Tab).
  3. All secondary servers that receive the notify message can then respond by initiating a zone transfer request back to the notifying master server.

The normal zone transfer process can then continue as described in the previous section.

Example OF Zone Transfer Process
Configuring notify lists

Notify lists can be created and managed to provide a method for a master server for a zone (such as the primary server or another secondary server) to notify a list of secondary servers when the zone changes.

To create or manage a notify list, you can use the DNS console to add and remove servers by their IP addresses in the notify list for a zone. By default, the notify list is based on the authoritative servers for the zone as listed on the Name Servers tab.

You cannot configure a notify list for a stub zone.

Name Servers in WINDOWS 2003 Server

در شکل بالا مشاهده می کنید که فقظ یک سرور وجود دارد که برای این Zone یک Authoritative DNS Server بحساب می آید

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Properties For Active Directory Integrated Zone - Name Servers Tab


Winteacher.com DNS Properties-SecurityTab-ADSIntegrated Zone

2003-2005

> Part2 > DNS > Properties For Active Directory Integrated Zone - Security Tab

وقتی از یک Active Directory Integrated Zone استفاده می شود بجز بهتر شدن کارایی آن در Replication دارای امنیت

بالاتر نسبت به دیگر نوع Zone ها می با شد که آن این Security Tab می باشد . در این نوع Zone ها فقط افراد یا گروهایی که معرفی

شده اند با Permission های مختلف می توانند این Zone را Modify کنند .

در این میان EnterPrise Admins Group بالا ترین قدرت را برای Modify کردن یک Zone دارد نسبت به Domain Admins Group و

Administrator Users به همین دلیل می توان دسته بندی کرد امنیت هر Zone را بین Admin های شبکه . گروه DNS Admins نیز برای

مشخص کردن این افراد با قدرت Permission بالا کارایی دارد .EnterPrise Admins Group می توانند بصورت Remote نیز بر روی هر

Zone فعالیت داشته باشند . در این نوع Zone ها سازنده هر Object یا Create Owner هر Object برآن Full Control دارد

هر Authenticated User آن سرور یک Permission برObject های Zone دارد ولی همیشه User های Domain Forest

بر آن Object قدرت بیشتری دارند مخصوصا گروه DNS Admins وEnterPrise Admins در هر Domain.

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Properties For Active Directory Integrated Zone - Security Tab


Winteacher.com DNS Properties ZoneTransfer-ADSIntegrated Zone

2003-2005

> Part2 > DNS > Properties For Active Directory Integrated Zone - Zone transfer Tab

در این قسمت برای مشخص کردن IP Address سرور هایSecondary موجود در Network و فرستادن یک کپی از Zone موجود در

ADS برای آنها استفاده می شود .

Allow zone transfer

اگر این گزینه فعال باشد سرور می تواند عمل Transfer را با Secondary Server ها انجام دهد .

DNS Domain Name Service (Farsi User Guide)

LastUpdate:2005/04/05

> Part2 > DNS > Properties For Active Directory Integrated Zone - Zone transfer Tab


You can manually enable or disable aging and scavenging on a per

You can manually enable or disable aging and scavenging on a per-server, per-zone, or per-record basis. You can also enable aging for sets of records by using the command line tool Dnscmd.exe. (For information about Dnscmd.exe, see Windows 2000 Support Tools Help. For information about installing and using the Windows 2000 Support Tools and Support Tools Help, see the file Sreadme.doc in the directory \Support\Tools on the Windows 2000 operating system CD.) Keep in mind that if you enable scavenging on a record that is not a dynamic update record, the record will be deleted if it is not periodically refreshed, and you must recreate the record if it is still needed.

If scavenging is disabled on a standard zone and you enable scavenging, the server does not scavenge records that existed before you enabled scavenging. The server does not scavenge those records even if you convert the zone to an Active Directory–integrated zone first. To enable scavenging of such records, use the AgeAllRecords in Dnscmd.exe.


Winteacher.com DNS Interoperability with Other DNS Servers

Interoperability with Other DNS Servers

1
1
1
1
1
1
1
Berkeley Internet Name Domain (BIND)


Winteacher.com DNS Resource records reference

A

Description: Host address (A) resource record. Maps a DNS domain name to an Internet Protocol (IP) version 4 32-bit address. For more information, see RFC 1035.

Syntax:
owner class ttl A IP_v4_address

Example:

host1.example.microsoft.com.     IN  A  127.0.0.1

AAAA

Description: IPv6 host address (AAAA) resource record. Maps a DNS domain name to an Internet Protocol (IP) version 6 128-bit address. For more information, see RFC 1886.

Syntax:
owner class ttl AAAA IP_v6_address

Example:

ipv6_host1.example.microsoft.com.     IN  AAAA  4321:0:1:2:3:4:567:89ab

AFSDB

Description: Andrew File System Database (AFSDB) resource record. Maps a DNS domain name in the server_host_name field to the host name for a server computer of a server subtype. The subtype field can have either of the following recognized and supported values:

  • A value of 1 to indicate that the server is an AFS version 3.0 volume location server for the named AFS cell.

  • A value of 2 to indicate that the server is an authenticated name server holding the cell-root directory node for the server that uses either Open Software Foundation's (OSF) DCE authenticated cell-naming system or HP/Apollo's Network Computing Architecture (NCA).

For more information, see RFC 1183.

Syntax:
owner ttl class AFSDB subtype server_host_name

Example:

example.microsoft.com.   AFSDB   1 afs-server1.example.microsoft.com.

ATMA

Description: Asynchronous Transfer Mode address (ATMA) resource record. Maps a DNS domain name in the owner field to an ATM address referenced in the atm_address field.

For more information, see "ATM Name System Specification Version 1.0" at the ATM Forum FTP site. At the ATM Forum FTP site, download af-saa-0069.000.doc or af-saa-0069.000.rtf.

Note

  • Web addresses can change, so you might be unable to connect to the Web site or sites mentioned here.

Syntax:
owner ttl class ATMA atm_address

Example:

atm-host   ATMA   47.0079.00010200000000000000.00a03e000002.00

CNAME

Description: Canonical name (CNAME) resource record. Maps an aliased or alternate DNS domain name in the owner field to a canonical or primary DNS domain name specified in the canonical_name field. The canonical or primary DNS domain name used in the data is required and must resolve to a valid DNS domain name in the namespace.

Syntax:
owner ttl class CNAME canonical_name

Example:

aliasname.example.microsoft.com.   CNAME   truename.example.microsoft.com.

HINFO

Description: Host information (HINFO) resource record. Specifies the type of CPU and operating system in the cpu_type and os_type fields, respectively, for the host DNS domain name in the owner field. Well-known CPU and operating system types that are most often used are noted in RFC 1700. This information can be used by application protocols such as FTP, which use special procedures when communicating with computers of a known CPU and operating system type.

Syntax:
owner ttl class HINFO cpu_type os_type

Example:

my-computer-name.example.microsoft.com.    HINFO   INTEL-386  WIN32

ISDN

Description: Integrated Services Digital Network (ISDN) resource record. Maps a DNS domain name to an ISDN telephone number. Telephone numbers used with this record should follow ITU-T E.163/E.164 international telephone numbering standards, which are compatible with current international phone numbering plans already in use. For more information, see RFC 1183.

Syntax:
owner ttl class ISDN isdn_address sub_address

Example:

my-isdn-host.example.microsoft.com.    ISDN   141555555539699 002

KEY

Description: Public key resource record. Contains a public key that is associated with a zone. In full DNSSEC implementation, resolvers and servers use KEY resource records to authenticate SIG resource records received from a signed zones. KEY resource records are signed by the parent zone, allowing a server that knows a parent zone's public key to discover and verify the child zone's key. Name servers or resolvers receiving resource records from a signed zone obtain the corresponding SIG record then retrieve the zone's KEY record. For more information, see RFC 2535.

Syntax:
owner class KEY protocol digital_signature_algorithm (DSA) public_key

Example:

widgets.microsoft.com IN KEY 0x0000 3 0

MB

Description: Mailbox (MB) resource record. Maps a specified domain mailbox name in the owner field to a mailbox host name in mailbox_hostname. The mailbox host name must be the same as a valid host address (A) resource record already used by a host in the same zone. Additionally, the specified host must have a domain mailbox that accepts mail for the specified owner. For more information, see RFC 1035.

Syntax:
owner ttl class MB mailbox_hostname

Example:

mailbox.example.microsoft.com.    MB   mailhost1.example.microsoft.com

MG

Description: Mail group (MG) resource record. Used to add domain mailboxes, each specified by a mailbox (MB) resource record in the current zone, to the domain mailing group identified by owner in this resource record. Names used in the mailbox_name field must be identical to valid mailbox (MB) resource records already present in the current zone. For more information, see RFC 1035.

Syntax:
owner ttl class MG mailbox_name

Example:

administrator.example.microsoft.com.    MG   mailbox1.example.microsoft.com
                                            mailbox2.example.microsoft.com

MINFO

Description: Mailbox mail list information (MINFO) resource record. Specifies (in responsible_mailbox) a domain mailbox name for a responsible person who maintains a mailing list or mailbox specified in the owner field. The error_mailbox field can also be used to specify a domain mailbox that receives error messages related to this mailing list or mailbox. Mailboxes specified for responsible contacts and error forwarding must be the same as valid mailbox (MB) records that already exist in the current zone. For more information, see RFC 1035.

Syntax:
owner ttl class MINFO responsible_mailbox error_mailbox

Example:

administrator.example.microsoft.com.    MINFO  resp-mbox.example.microsoft.com err-mbox.example.microsoft.com

MR

Description: Mailbox renamed (MR) resource record. Specifies a domain mailbox name in new_renamed_mailbox, the proper rename of an existing mailbox specified in the owner field. An MR resource record is often used as a forwarding entry for a user who has moved to a different mailbox. MR records do not cause additional section processing. For more information, see RFC 1035.

Syntax:
owner ttl class MR new_renamed_mailbox

Example:

old-mbox.example.microsoft.com.    MR  new-renamed-mbox.example.microsoft.com

MX

Description: Mail exchanger (MX) resource record. Provides message routing to a mail exchanger host, as specified in mail_exchanger_host, for mail sent to the domain name specified in the owner field. A 2-digit preference value indicates preferred ordering if multiple exchanger hosts are specified. Each exchanger host must have a corresponding host (A) address resource record in a valid zone. For more information, see RFC 1035.

Syntax: owner ttl class MX preference mail_exchanger_host

Example:

example.microsoft.com.    MX  10 mailserver1.example.microsoft.com

NS

Description: Used to map a DNS domain name as specified in owner to the name of hosts operating DNS servers specified in the name_server_domain_name field.

Syntax: owner ttl IN NS name_server_domain_name

Example:

example.microsoft.com.    IN NS  nameserver1.example.microsoft.com

NXT

Description: Next resource record. NXT resource records indicate the nonexistence of a name in a zone by creating a chain of all of the literal owner names in that zone. They also indicate what resource record types are present for an existing name. For more information, see RFC 2535.

Syntax:
owner class NXT next_domain_name last_record_type NXT

Example:

east.widgets.microsoft.com. IN NXT ftp.widgets.microsoft.com. A NXT

OPT

Description: Option resource record. One OPT resource record can be added to the additional data section of either a DNS request or response. An OPT resource record belongs to a particular transport level message, such as UDP, and not to actual DNS data. Only one OPT resource record is allowed, but not required, per message. For more information, see RFC 2671.

Syntax:
name OPT class ttl rdlen rdata

Example:

null  OPT  IN  1280  0  0

PTR

Description: Pointer (PTR) resource record. Points from the name in owner to another location in the DNS namespace as specified by targeted_domain_name. Often used in special domains such as the in-addr.arpa domain tree to provide reverse lookups of address-to-name mappings. In most cases, each record provides information that points to another DNS domain name location, such as a corresponding host (A) address resource record in a forward lookup zone. For more information, see RFC 1035.

Syntax:
owner ttl class PTR targeted_domain_name

Example:

1.0.0.10.in-addr.arpa.    PTR  host.example.microsoft.com.

RP

Description: Responsible Person (RP) resource record. Specifies the domain mailbox name for a responsible person in mailbox_name. This name is then mapped to a domain name in text_record_name for which (TXT) resource records exist in the same zone. When RP records are used in DNS queries, subsequent queries are used to retrieve associated text (TXT) resource record information. For more information, see RFC 1183.

Syntax:
owner ttl class RP mailbox_name text_record_name

Example:

example.microsoft.com.               RP    admin.example.microsoft.com.  admin-info.example.microsoft.com.
admin-info.example.microsoft.com.    TXT  "Joe Administrator, (555) 555-0110"

RT

Description: Route through (RT) resource record. Provides an intermediate host binding for internal hosts that do not have a direct wide area network (WAN) or external network connection. The RT record is similar to the MX record in that any communication from an internal host is routed through the intermediate_host for the destination DNS domain name specified in the owner field. A 2-digit preference value is used to set priority if multiple intermediate routing hosts are specified. For each intermediate host specified, a corresponding host (A) address resource record is needed in the current zone. For more information, see RFC 1183.

Syntax:
owner ttl class RT preference intermediate_host

Example:

example.microsoft.com.    RT    2 lan-router.example.microsoft.com
                          RT   10 wan-router.example.microsoft.com

SIG

Description: Signature resource record. Encrypts a RRset to a signer's (RRset's zone owner) domain name and a validity interval. For more information, see RFC 2535.

Syntax:
owner class SIG ttl signature_expiration signature_inception key_identifier signer_name{digital_signature}

Example:

widgets.microsoft.com IN SIG 86400 19700101000000 19700101000000 49292

widgets.microsoft.com.{

AIYADP8d3zYNyQwW2EM4wXVFdslEJcUx/fxkfBeH1El4ixPFhpfHFElxbvKoWmvjDTCmfiYy2X+8XpFjwICHc398kzWsTMKlxovpz2FnCTM=

}

SOA

Description: Start of authority (SOA) resource record. Indicates the name of origin for the zone and contains the name of the server that is the primary source for information about the zone. It also indicates other basic properties of the zone. The SOA resource record is always first in any standard zone. It indicates the DNS server that either originally created it or is now the primary server for the zone. It is also used to store other properties such as version information and timings that affect zone renewal or expiration. These properties affect how often transfers of the zone are done between servers authoritative for the zone. For more information, see Managing authority records.

Note

  • In the example below, the owner (primary DNS server) is specified as "@" because the domain name is the same as the origin of all data in the zone (example.microsoft.com.). This is a standard notation convention for resource records and is most often seen in the SOA record.

Syntax:
owner class SOA name_server responsible_person (serial_number refresh_interval retry_interval expiration minimum_time_to_live)

Example:

@   IN  SOA     nameserver.example.microsoft.com.  postmaster.example.microsoft.com. (
                               1            ; serial number
                               3600         ; refresh   [1h]
                               600          ; retry     [10m]
                               86400        ; expire    [1d]
                               3600 )       ; min TTL   [1h]

SRV

Description: Service locator (SRV) resource record. Allows multiple servers providing a similar TCP/IP-based service to be located using a single DNS query operation. This record enables you to maintain a list of servers for a well-known server port and transport protocol type ordered by preference for a DNS domain name. For example, in Windows Server 2003 DNS, it provides the means to locate domain controllers that use Lightweight Directory Access Protocol (LDAP) service over TCP port 389.

The purposes of each of the specialized fields used in an SRV resource record are as follows:

  • service A symbolic name for the desired service. For well-known services, a reserved universal symbolic name such as "_telnet" or "_smtp" is defined in RFC 1700. If a well-known service name is not defined in RFC 1700, a local or user-preferred name can be used instead. Some widely used TCP/IP services, notably the Post Office Protocol (POP), do not have a single universal symbolic name. If RFC 1700 assigns a name for a service indicated in this field, the RFC-defined name is the only name that is legal to use. Only locally defined services can be named locally.

  • protocol Indicates the transport protocol type. Typically, this is either TCP or UDP, although any transport protocol named in RFC 1700 can be used.

  • name The DNS domain name referred to by this resource record. The SRV resource record is unique among other DNS record types in that it is not used to perform the search or query.

  • priority Sets the preference for a host specified in the target field. DNS clients that query for SRV resource records attempt to contact the first reachable host of the lowest numbered preference listed here. Although target hosts have the same stated preference value, they can be tried in random order. The range of preference values is 0 to 65535.

  • weight Can be used in addition to preference to provide a load-balancing mechanism where multiple servers are specified in the target field and are all set to the same level of preference. When selecting a target server host among those of equal preference, this value can be used to set an added level of preference that can be used to determine the exact order or balancing of selection for the target hosts used in an answered SRV query. When a non-zero value is used, servers of equal preference are tried in proportion to the weight of this value. The range of values is 1 to 65535. If load balancing is not needed, use a value of 0 in this field to make the record easier to read.

  • port The server port on the target host that provides the service indicated in the service field. The range of port numbers is 0 to 65535, although the number is often a well-known assigned service port number, as specified in RFC 1700. Unassigned ports can be used as needed.

  • target Specifies the DNS domain name of the host that provides the type of service being requested. For each host name used, a corresponding host address (A) resource record in the DNS namespace is required. A single period (.) can be used in this field to indicate authoritatively that the requested service specified in this SRV resource record is not available at this DNS domain name.

For more information, see the Internet draft "A DNS RR for specifying the location of services (DNS SRV)."

Syntax:
service.protocol.name ttl class SRV preference weight port target

Example:

_ldap._tcp._msdcs    SRV  0 0   389 dc1.example.microsoft.com
                   SRV 10 0   389 dc2.example.microsoft.com

TXT

Description: Text (TXT) resource record. Maps a DNS domain name specified in the owner field to a string of characters in text_string serving as descriptive text. For more information, see RFC 1035.

Syntax:
owner ttl class TXT text_string

Example:

example.microsoft.com.    TXT  "This is an example of additional domain name information."

WKS

Description: Well-known service (WKS) resource record. Describes the well-known TCP/IP services supported by a particular protocol on a specific IP address. WKS records provide TCP and UDP availability information for TCP/IP servers. If a server either supports both TCP and UDP for a well-known service or has multiple IP addresses that support a service, then multiple WKS records are used. For more information, see RFC 1035.

Syntax:
owner ttl class WKS address protocol service_list

Example:

example.microsoft.com.    WKS  10.0.0.1 TCP ( telnet smtp ftp )

X25

Description: X.25 (X25) resource record. Maps a DNS domain name in the owner field to a Public Switched Data Network (PSDN) address number specified in psdn_number. PSDN numbers used with this record should follow the X.121 international numbering plan. For more information, see RFC 1183.

Syntax:
owner ttl class X25 psdn_number

Example:

example.microsoft.com.    X25  52204455506

Managing core network services Microsoft Windows 2000 Server