In this section I will look a configuring DNS replication. DNS replication is the process
of updating DNS records on different servers so that they contain the same data. This occurs
in what is called a zone transfer. So what is a zone transfer? A zone transfer
is the transfer of records between DNS servers. A transfers is the process the keeps multiple
copies of zone up to date on multiple servers. If you are using active directory integrated
zones, this process happens between domain controllers with the rest of the active directory
database. If you are using primary zones this happens
between the primary zone and the secondary zone or zones. There can only every be one
primary zone, however you can have as many secondary zones as you wish. You can also
have zone transfers between secondary zones and other secondary zones.
Finally you can set up transfers between active directory integrated zones and secondary zones.
If you don’t have your zone transfers set up correctly or they stop working, this can
cause problems in your network as the DNS records start to change and clients start
not being able to find resources on the network. Once you have worked out which types of zones
you want and how many, you need to set up replication. If you use active directory integrates
zones the replication will happen with the active directory replication because it is
stored in active directory. In other words, it uses the same schedule
as active directory. Keep this in mind because if you decide to replicate your active directory
database outside business hours, your DNS data will also be replicated outside business
hours. Also if for any reason the active directory replication fails, so will your DNS zone replication.
If you are finding that your active directory integrated zones have stop replication, check
the event viewer for active directory related errors. The big advantage with active directory
integrated zones is that if you need to recovery your DNS data and all your DNS servers are
not available, all you need to do is install DNS on a working domain controller.
If you are using primary or secondary zones, the big thing that you need to do is set security
on the zone so that other DNS servers can replicate the data. By default no one can
replicate DNS data from your DNS server. Once your security is set up, the secondary
zone needs to perform zone replication to keep it's records up to date. Firstly zone
replication can be triggered by the refresh interval expiring. This is set in the start
of authority record. The next way is when the server holding the secondary DNS zone
boots up. The last way replication can happen is when
the primary zone notify the secondary zone that a change has occurred. When this happens,
the secondary zone will request a zone transfer from the primary zone. To better understand
how zone replications works, let’s have a look at how to configure it.
To perform this demonstration I have installed DNS on a domain controller so I can take advantage
of active directory integrated zones. To make changes to D N S, first open the DNS admin
tool from administrative tools under the start menu.
If I expand down to forward look up zone you will notice the zone test dot local. This
was created when active directory was installed. To find out more about the zone right click
on it and select properties. You will notice at the top you can see that the type is active
directory integrated. Even though the zone type was set during the
active directory install, you can change it at any time. If I press the change button
I can change the zone to a secondary or even a stub zone. If I no longer want to store
the zone in active directory I can deselect the tick box store the zone data in active
directory. If you don’t feel confident storing your
zone data in active directory, you can feel confident that you can always change your
mind at any time and store it in active directory or remove it from active directory if you're
not happy with the result. While the zone is stored in active directory
it will automatically be replicated with active directory. Currently the zone data is being
replicated to all DNS servers in the domain, but this can be changed by pressing the change
button. If you change the option to all DNS servers
in the forest, all domain controllers in the forest will receive zone replications data
from this DNS Server. If you have a large forest with a lot of domains and domain controllers,
this can become a large amount of data. If you have a requirement for users in other
domains in the same forest to resolve DNS names from this zone, consider creating a
stub zone. A stub zone will direct DNS queries to an authority DNS server for that domain
but only contains a small amount of data when compared with a complete DNS zone. This allows
your users to resolve names in different parts of the forest without a large amount of replication
data. If you only need to resolve DNS names in the
same domain select the option all DNS servers running on domain controllers in this domain.
Remember, this will replicate the data to all domain controller in the domain, but it
will not be accessible to your users unless you install DNS on that domain controller.
Lastly if you have any windows 2000 domain controllers you will need to select the last
option. Even though this zone is replicated with active directory, if I now go to the
start of authority tab, you will notice at the top the serial number. The serial number
is not required by active directory integrated zones, but is used in primary and secondary
zones. Each time a record is updated in the DNS zone
the serial number will be incremented. Secondary zones use this serial number to determine
which version of the zone data that they have. The value refresh interval is used by the
secondary zones. A DNS server with a secondary zone will query the primary zone at the refresh
interval time. In this case 15 minutes. Every 15 minutes a server holding the secondary
zone will requested the start of authority record from the server containing the primary
zone or active directory integrated zone. If it finds that the serial numbers are different,
the DNS server will request a zone transfer. The retry interval is the time period the
secondary DNS zone will wait to retry a zone transfer if the zone transfer fails. The "expires
after" value determines when the DNS server will consider the data unreliable when no
zone transfers are occurring. In this case, if after a day no zone transfers to the secondary
zone have occur, the data on the secondary server will be considered to be out of date
and thus unreliable. The time to live value will determine how
long a cache record will stay on the server before it is forgotten. This does not apply
to records in the zone, only records that have been cached from anther server in responds
to a DNS query. These settings are primary used by secondary zones.
Before you can start replicating data to a secondary zone, you need to enable zone transfers.
This is done on the zone transfers tab. If I select the option allow zone transfers,
by default zone transfers will be allowed to any DNS server that requests one. If you
value your DNS records, you will want to set some security on your DNS zone transfers or
anyone who wanted your zone data could simply just request a zone transfer.
If you want to limit who can receive zone transfers you can select the option only the
following servers. By selecting this option and then pressing the edit button, I can enter
in the name of DNS servers that I want to receive zone updates. Notice that when I enter
in the name of the DNS server it is resolved to an I P address. The I P addresses have
red X’s next to them, but if I expand the dialog box so I can see the message, you can
see that it is simply telling us that the DNS server is not any authority for that zone.
In simply terms, this means it could not local the zone on the server because it has not
been created yet. Using this method uses the I P address which could change. If you want
to use a DNS name rather than an I P address I need to select the option “only to servers
listed in the name servers tab.” If you select this option, the servers on
the names server tab will be used. On the names server tab I can press the add button
and enter in the name of DNS server that I want to use. If I press resolve you will notice
that again the DNS name is resolve to an I P address. When I press o.k. you will notice
that this time the DNS name is recorded instead of the I P address.
Now that I have to set up the security of zone replication, I can set up another DNS
server to have a secondary zone for this zone. To do this, I can connect to the other DNS
server simply called DNS by right clicking on the top of the DNS admin top and entering
in the name of the DNS server. Once connected to the other DNS server I can create a secondary
DNS zone. To do this, right click on forward look up
zone and select new zone. Select the option secondary zone in the wizard. Once you have
done this you need to enter in the name of the zone, in this case it is a secondary zone
for test dot local. Now all I need to do is enter in the DNS server
that is holding the primary zone. In this case D C 1. Once I complete the wizard the
secondary zone will be created. Once the zone is created, a zone transfer should happen
straight away. If I now expand the zone you will notice that the zone has been populated
with records. If you find that there are no records in the
zone, you can always right click on the zone and select the option transfer from master.
This will force a zone transfer to happen immediately. With carefully planning, your
DNS infrastructure should replicate without any issue, however if it does stop you may
develop problems throughout your network. Make sure you save yourself some troubleshooting
headaches by giving your DNS deployment careful thought.