In this video from ITFreeTraining I will look at how forwarding and conditional forwarding
work in DNS. Forwarding allows you to forward DNS requests from one DNS server to another
to be resolved. Conditional Forwarding allows you to place conditions on which DNS requests
get sent to which DNS servers. This video will look at how you can use both in your
organization to meet your needs. DNS forwarding is the process of forwarding
DNS requests from one DNS server to another. To understand better, consider a common example
of when DNS forwarding is used. A company will often forward DNS requests from their
internal DNS server to their ISP's DNS server. This is more efficient than resolving the
DNS request themselves as the ISP may have already resolved that DNS request and have
the result stored in the ISP's DNS server cache.
The next common form of DNS forwarding is when the company has an internal DNS server
that they do not want to have directly connected to the internet. The internal DNS will contain
the DNS records for the local network like records for the company's servers and clients
and also records for services like Active Directory.
The DNS server will still be able to resolve DNS names on the internet even though it does
not have direct access by forwarding DNS requests to a DNS server in the perimeter or DMZ network.
This DNS server will generally forward the DNS request again to the ISP's DNS server.
This means that only the DNS server on the DMZ has direct access to the internet. If
the DNS server on the DMZ was to become compromised the attacker would not have access to the
DNS record used on the internal network. The only DNS records they have access to would
be cached DNS records stored on the server. The next type of forwarding you may use is
conditional forwarding. To understand where conditional forwarding would be useful consider
this example. Say that ITFreeTraining acquires another company called HighCostTraining. The
companies have separate infrastructure but due to the acquisition need to access resources
in each other's network. Both companies forward their DNS requests
to their ISP DNS Server. The problem with this approach is the ISP DNS will not be able
to resolve DNS requests for the other domains as these domains are internal only. You could
have the DNS records resolvable from the internet, however this does reduce the security of your
network. Also if your domain name ends in a non-registrable name like local, this will
not be resolved using an internet server. A way around this is to configure conditional
forwarding. This is the same as regular forwarding except that forwarding is only done if a condition
is met. In this example, a conditional forwarder could be configured on ITFreeTraining to forward
all requests received by the ITFreeTraining DNS server for HighCostTraining to the HighCostTraining
DNS server. The same could also be configured on the HighCostTraining DNS Server. All requests
for ITFreeTraining received by HighCostTraining DNS server could be forwarded to the ITFreeTraining
DNS server. By using conditional forwarding like this, you can see that you can achieve
a result that would not normally be possible. Thanks for watching this video on forwarding
and conditional forwarding. In the upcoming videos I will look at how to configure DNS
forwarding and conditional forwarding to meet the needs of your organization. Thanks for
watching and see you next time.