DESIGNING THE DNS STRUCTURE

1
DESIGNING THE DNS STRUCTURE

• Chapter 2

2
NAME RESOLUTION PROCESS
3
DNS FORWARDING
4
DNS DELEGATION AND NAME RESOLUTION
5
ANALYZING THE EXISTING DNS IMPLEMENTATION
6
COMPONENTS OF DNS

• DNS zones
• Zone transfers
• Server roles

7
DNS ZONES
8
ZONE TRANSFERS

• Full zone transfer (AXFR)
• All resource records for a zone are copied.
• Incremental zone transfer (IXFR)
• Only the changes made to resource records are
  copied.
• Results in less network traffic.

9
SERVER ROLES

• Primary DNS server
• Contains the local zone database file
• Secondary DNS server
• Contains a copy of the zone database file
• Caching-only DNS server
• Caches the answers to queries and returns the
  results
• Does not contain zone information

10
IDENTIFYING THE CURRENT NAMESPACE
11
DNS NAMESPACE DESIGN

• The following business needs affect the DNS
  naming strategy
• The intended scope of Active Directory
• Internet presence
• Whether DNS must support Active Directory

12
CHOOSING A DNS NAME

• Choose and register a root domain name that is
  unique on the Internet.
• The root domain name must conform to DNS naming
  standards.
• Choose meaningful, stable, scalable names.
• The root domain name can be an existing DNS
  domain name.

13
DNS INTEROPERABILITY WITH ACTIVE DIRECTORY

• Active Directoryintegrated zone transfers
• Multi-master replication
• Fault tolerance
• Secure updates
• Single replication topology

14
DNS INTEROPERABILITY WITH ACTIVE DIRECTORY
15
DNS INTEROPERABILITY WITH DHCP
16
DNS INTEROPERABILITY WITH WINS
17
ZONE REQUIREMENTS
18
SECURITY

• Potential security threats
• Securing the DNS infrastructure
• Securing replication data

19
SECURING THE DNS INFRASTRUCTURE

• Use a private namespace
• UDP and TCP port 53
• Disable recursion
• Restrict zone transfers
• NTFS
• Secure updates

20
SECURING REPLICATION DATA
21
DNS INTEROPERABILITY WITH UNIX BERKELEY INTERNET
NAME DOMAIN (BIND)

• Windows Server 2003 DNS offers maximum
  compatibility with Active Directory.
• BIND DNS servers can be integrated with Active
  Directory.
• BIND 8.2.2 and later support dynamic updates.

22
WINDOWS SERVER 2003 DNS AND BIND COMPARED
23
DESIGNING DNS SERVER PLACEMENT
24
SERVER PLACEMENT

• Fault tolerance
• High availability

25
MONITORING DNS
26
CACHING-ONLY DNS SERVERS
27
LOAD BALANCING
28
SUMMARY

• Before you design DNS, what information do you
  need about the existing DNS infrastructure?
• What are some of the benefits of choosing Active
  Directoryintegrated zones?
• What factors influence the DNS namespace design?
• How can zone replication data be secured?
• What are some ways to improve DNS performance?