Table of Contents
What Is DNS Domain Name Server?
The Domain Name System is a protocol and a service that is used for IP address to Hostname resolution and vice versa. The DNS protocol uses port number 53. Basically, the DNS server is used to store the database of a network containing IP addresses and their Hostname which are used to map each other. The DNS server can be configured in only Server Operating System. It cannot be configured in the client Operating System.
In addition to resolving the hostname to IP addresses, you can also use DNS to do the following task.
- Locate domain controllers and global catalog servers. This is used when signing in to AD DS.
- Resolve IP addresses to host names. This is useful when a log file contains only IP address of a host.
- Locate network services that register their names to DNS.
Domain Name System Hierarchy
DNS maintains a database using a hierarchical structure of domains. The naming structure used in DNS is called the DNS namespace. It begins with a root domain at its apex, then maintains Top Level Domain or parent domains, and then below that it holds child domains. In our example hostname is champ.eihtech.com. Here, COM is the parent domain, EIHTECH is the child domain and CHAMP is the NetBIOS name of the computer. champ.eihtech.com is called Fully Qualified Domain Name (FQDN).
On the internet, there are 13 root server clusters named A-M with servers in over 380 locations. They are managed by 12 different organizations that report to the Internet Assigned Number Authority (IANA), such as Verisign. All of the servers are copies of one master server run by IANA. This root server holds the locations of all of the top-level domains. (TLDs). There are two types of TLDs, country codes (ccTLDs) run by government organizations, and generic (gTLDs) such as .com, .net, .edu. and .gov. These are distributed and managed by Internet Corporation for Assigned Names and Numbers (ICANN). To participate in the Internet DNS namespace, a domain name must be registered with a DNS registrar. For example, ‘eiheducation’ domain is registered with ‘.com’ gTLD. This ensures that no two organizations attempt to use the same domain name. If hosts that are located on the Internet do not need to resolve names in your domain, you can host a domain internally, without registering it. However, you must ensure that the domain name is unique from Internet domain names, or connectivity to Internet resources might be affected. A common way to ensure uniqueness is to create an internal domain in the .local domain. The .local domain is served for internal use in much the same way that private IP addresses are reserved for internal use.
Domain Name System Name Resolution Process
In the DNS name resolution process; there are two types of queries i.e. Recursive Query and Iterative Query. The DNS client requests the www.eiheducation.com webpage. So the DNS client sends the query for the webpage to the DNS server. This query is known as a Recursive query i.e. the queries made by the DNS clients to the DNS servers are known as Recursive queries. In a recursive query, the DNS client expects that the DNS server should provide it required to answer or say that page cannot be found.
Then the DNS server queries the webpage to the root DNS server which is the root level domain. This root server cannot find the webpage but it knows about the com server. So it tells the DNS server to send the query to the .com server. The .com server also does now know about the webpage but has the knowledge about the eihtech.com domain and then tells the DNS server to make the query to the eihtech.com domain. The DNS server then sends queries to the eihtech.com domain which has the knowledge about the www.eihtech.com webpage. It sends a positive response to the DNS server and redirects it directly to the webpage of www.eihtech.com. Now the DNS server makes the same query to a number of DNS servers continuously. This query is known as an iterative query which is performed at iterations. So the query sent from a DNS server to another DNS server is known as an Iterative query.
You can change the name resolution process in several ways, but common options that you can use are as follows,
Caching: Once a local NDS server resolves a DNS name, it will be saved in cache for approximately 24 hours. The next query for the same DNS name will be resolved with the information in the cache.
Forwarding: Sometimes Forwarders are configured on the local DNS server. So the queries will not be directed to Root servers. Instead, those queries will be guided to another DNS server specified in Forwarders.
Host File: Windows operating system also contain a Hosts file in the %SystemRoot%\System32\Drivers\Etc directory. The file can contain mappings for hostnames to IP addresses.
DNS resolver cache: DNS client machine facilitates the caching of recently resolved queries locally.
Domain Name System Infrastructure Components
DNS server: It maintains the database of hostname and their IP addresses. It resolves the query from client machines. It holds the information in cache temporarily. If a query cannot be resolved by DNS Server, that query will be forwarded to Root Servers or another DNS serve.
The query will be forwarded to Root Servers or another DNS server.
DNS zones: In addition to dividing your Domain Name System (DNS) namespace into domains, you can also divide your DNS namespace into zones that store information about one or more DNS domains. A zone is an authoritative source for information about each DNS domain name is included in that zone. You can relate zones with logical subnets created in a single network for better management. Multiple zones can be stored in one server or multiple servers can hold a database of a single zone. Zone records are maintained using two types of lookup zones. Forward lookup zones hold a mapping of hostnames to IP addresses and Reverse lookup zones hold a mapping of IP addresses to hostnames.
DNS forwarders: When an authorized server cannot resolve the query from its client with tits database or caching information it will be forwarded to another DNS server specified in the Forwarded option.
DNS delegation: When the DNS namespace database of an organization is difficult to manage under one logical domain, some database management is delegated to downstream DNS servers. Those servers are called delegated DNS Servers.
Root Hints: The information about internet Rootservers is stored in Root Hints. It is used to forward the unresolved query to the Internet clusters of Root servers.
Resource records: The entries in the DNS database that are used to answer queries are called resource records. Some typical record types are as follows,
A: This record is used for resolving hostnames into IPv4 addresses.
AAAA: This record is used for resolving hostname into IPv6 addresses.
CNAME: This record is used to resolve one name (alias) into another, fully qualified name, such as www into champ.eiheducation.com
SRV: This record is used to find servers providing specific services, such as domain controllers.
PTR: This record is used in reverse lookup zones for resolving IP addresses into a fully qualified hostname.
A mail exchanger (MX): This record is used to identify Simple Mail Transport Service (SMTP) servers.
Start of Authority (SOA): This record is used to identify the Primary DNS server for a zone.
Name server (NS): This record is used to identify all DNS servers in a zone.
Dynamic update: Dynamic updates are information’s regarding changes made to resources in the domain. They will be registered in the DNS database without manual intervention. The registration occurs during the following events.
- When the client starts and the DHCP client service is started.
- When an IP address is configured, added, or changed on any network connection.
- When an administrator executes the Windows PowerShell cmdlet Register-DNSClient or runs the ipconfig /registerdns at a command prompt.
We can select the Dynamic secure or non-secure option or Manual update option during DNS configuration.
Prerequisites of DNS server
For deploying DNS server role following are the recommended requirements,
- Computer system with Windows Server 2016.
- Properly configured Time Zone.
- Computer must have static IP address.
- Computer name should be properly assigned.
- Administrator password should be complex to avoid security loophole.
DNS Zone Types
Primary zone: When we deploy the first DNS server in the domain, it has to be the primary DNS zone. It is the first source of domain information. All other Name Servers will receive updates about the changes in the domain from the Primary DNS zone. In Primary DNS, the database file is stored in the %windir%\System32\Dns folder. When the zone is not stored in AD DS, the primary zone server is the only DNS server that has a writable copy of the database. When the Primary zone is online we will be able to resolve the query as well as make changes in the database.
Secondary zone: It is a read-only replicated copy of the Primary DNS database. The updates cannot be directly written to the Secondary zone. Any modification in the domain will be first written on the Primary zone database file and then updated information will be passed on to the Secondary zone. The secondary zone is able to resolve the queries but in the absence of Primary zone records cannot be modified in the DNS database.
Stub zone: Stub zone contains only those resource records necessary to identify that zone’s authoritative DNS servers. Stub zones will not be able to resolve the query. Stub Zone can only forward the query to authorized DNS servers.
Active Directory-integrated zone: Domain Name System (DNS) servers running on domain controllers can store their zones in Active Directory Domain Services (AD DS). In this way, it is not necessary to configure a separate DNS replication topology that uses ordinary DNS zone transfers because all zone data is replicated automatically by means of Active Directory replication. This simplifies the process of deploying DNS and provides the following advantage.
Multiple masters are created for DNS replication. Therefore, any domain controller in the domain running the DNS Server service can write updates to the Active Directory-integrated DNS zones for the domain name for which they are authoritative. A separate DNS zone transfer topology is not needed.
Secure dynamic updates are supported. Secure dynamic updates allow an administrator to control what computers updates what names and prevent unauthorized computers from overwriting existing name in DNS.
