Welcome to the ITFreeTraining video on configuring root hints server on Windows DNS server. Root
hint servers are the first server contacted in order to start resolving a DNS request.
On most networks you will never need to configure the root hint servers. This video will help
you understand how the root hint servers are configured in case you have a rare case in
which you need to make changes. I will now change to my Windows 8 computer with Remote
administration tools installed to look at how to configure root hints in DNS for Windows
Server. First of all I will open charms and go to
the search option. To access DNS manager directly, I will enter in DNSMGMT.MSC in the search.
Once DNS Manager has opened, I will enter in my DNS server which in this case is NYDC1.
Once DNS manager has loaded, I will next right click on NYDC1 and select the option properties.
Once the properties have opened, I will next select the tab forwarders. Notice at the bottom
is the tick box, “Use root hints if no forwarders are available”. It is currently grayed out
because no forwarders have been configured. To allow this option to be changed, I will
press edit and add a forwarder. In this case I will use the IP address of Google’s publicity
available DNS server. Once I have entered in a forwarder, notice that now I can un-tick
the tick box “Use root hints if no forwarders are available”. If the forwarder is not
available, the DNS server will use the root hint server, but when would you want to use
or disable this option? To understand why, consider a typical deployment.
In this case you have an internal DNS server. This DNS server forwards DNS queries to a
DNS server on a perimeter or DMZ network. This server then forwards DNS queries to the
ISP’s DNS server. Let’s consider what would happen if the
DNS server on the DMZ were to become unavailable. If this were to occur, the internal DNS server
would attempt to use the root hint server to start the DNS resolving process. So essentially
what you now have happening is an internal DNS server that is not suppose to be directly
communicating with the internet is now attempting to contact a root hint server on the internet.
If it is able to do this, it will then start contacting other DNS servers on the internet
attempting to resolve the DNS query. You can see why many administrators would
consider this poor security and would switch off the ability for the DNS server to contact
the root hint server. This of course would mean that while the perimeter DNS server is
down, no internal clients would be able to resolve DNS requests so the administrator
would need to ensure that outages, if they occurred, were short.
In this particular case, I will leave this tick box ticked and then move onto the advanced
tab. Notice at the top the option “Disable recursion (also disables forwarders)” This
tick box when ticked will prevent the DNS server from contacting any other DNS server
if it does not know the answer to the DNS query. It will not attempt to contact any
root hints servers or forwarders even if these options are configured. You would most likely
use this option on a secure network that is isolated from other networks. The only other
time that you may want to enable this option is when you have multiple DNS servers and
you only want particular DNS servers to only resolve DNS requests and other DNS server
to ignore the request. If I select the next tab, root hints, this
shows the 13 root hints servers that are configured. Due to a limitation of the UDP protocol when
DNS was first developed, the max number of root hints servers is limited to 13.
It should be pointed out that a root hint server is not one physical server. A root
hints server is installed on a high availability cluster and some of the root hints servers
use anycast making them available from multiple locations. For this reason, your DNS server
shouldn’t have any trouble contacting at least one of the root hints servers considering
their availability. The data for the root hints servers is stored
in the Windows directory. To see this, I will open Windows Explorer, and go to \\NYDC1\C$.
Remember that I am using remote access tools to access the DNS server, so to access the
c drive on NYDC1 I need to use the hidden administration share on that server.
Next I need to go to the Windows directory, System32 and then the directory DNS. In this
directory there is a file called cache. If I open the file and scroll down through it,
you will notice all the root hint servers defined in the file.
I will now go back to the root hints tab, notice the first root hints server starts
with a. The last one ends in m. If I press edit you can see the IP address for this root
hints server, notice that it is an IPv4 address. If I were to go through all the other root
hints servers, they would all be IPv4 addresses. Just to prove a point, I will now remove all
the root hints servers. I would not recommend that you do this on your production network.
Once I press apply, the root hints servers will be removed. This DNS server will no longer
be able to resolve any DNS queries unless a forwarder is configured or the DNS records
asked for is stored on this DNS server. If I press the button, copy from server, this
will allow me to enter in an IP Address of another DNS server which can be used to obtain
a list of root hints servers. In this case I will enter in the IP address of my ISP’s
DNS server. Notice that once I press ok the root hints
servers will be restored. If I edit the first root hints server, notice that I now have
an IPv6 address of the root hints server which previously was not present. For the most part,
the root hint server addresses are static, however as time goes on you can see that new
IP addresses are added to the list. Well that covers it for root hints servers
in Windows Server. Thanks for watching this free video from ITFreeTraining. Please check
out our other free videos from the DNS courses and other courses. Till then, see you next
time.