DNS

Before DNS, Microsoft had WINS. It also provides name resolution service.

Windows DNS must read

https://technet.microsoft.com/en-us/library/ee649193%28WS.10%29.aspx

Windows DNS interview questions

http://www.techiebird.com/dns1.html

Domain Name System.

DNS is the backbone of the Internet. DNS provides name resolution and resolves IP to names and names to IPs. It is also an important component in Windows Active Directory.

dns-or-internet

DNS Root zone

The DNS root zone is the top-level DNS zone in the hierarchical namespace of the Domain Name System (DNS) of the Internet.

The DNS root zone is served by thirteen root server clusters which are authoritative for queries to the top-level domains of the Internet. Thus, every name resolution either starts with a query to a root server, or, uses information that was once obtained from a root server.

The root server clusters have the official names a.root-servers.net to m.root-servers.net.

DNS Root zone server clusters

a.root-servers.net     198.41.0.4            Verisign
b.root-servers.net     192.228.79.201     USC-ISI
c.root-servers.net     192.33.4.12          Cogent Communications
d.root-servers.net     199.7.91.13          University of Maryland
e.root-servers.net     192.203.230.10     NASA
f.root-servers.net      192.5.5.241          Internet Systems Consortium
g.root-servers.net     192.112.36.4        Defense Info Systems Agency
h.root-servers.net     128.63.2.53          US Army Research Lab
i.root-servers.net      192.36.148.17       Netnod
j.root-servers.net      192.58.128.30       Verisign
k.root-servers.net     193.0.14.129         RIPE NCC
l.root-servers.net      199.7.83.42           ICANN
m.root-servers.net     202.12.27.33        WIDE Project

You can also find these DNS root hints in your DNS. Right click the server -> Properties -> Root Hints

dns-root-hints

Each of these operators provides the service for free, and provide uninterrupted up time – after all, if any of these name servers went offline, entire portions of the internet would temporarily stop working.

Why root server clusters are limited to 13 ?

UDP protocol is used for DNS querying because UDP offers better performance compared to TCP. And due to performance issues, a UDP packet used for DNS is limited to 512 bytes, if your payload goes above 512 bytes, then TCP will be used.

TCP involves very high overhead, because it includes multiple steps and procedures to establish a TCP connection, that can slow the entire process.

Single UDP packet should contain all this 13 IP addresses along with other UDP protocol information (416 bytes of 13 ip addresses and remaining protocol information of UDP). We can have 30 or 40 DNS root server IP addresses, but you will not be able to send all of them in one UDP packet (you will have to send them in multiple packets, that will reduce the performance). Hence for performance and low network overhead the root servers are limited to 13 IP addresses.

How many Root servers are there ?

There are 504 Root servers as of Jan 2016. https://en.wikipedia.org/wiki/Root_name_server

Root servers in the world

https://www.google.com/maps/d/viewer?ll=24.846565%2C22.5&spn=123.841285%2C225&hl=en&t=m&msa=0&z=2&source=embed&ie=UTF8&om=1&mid=1LcHEpzl-7RzziWzDa4h3BxJcbEo

root-servers-in-the-world

There are multiple servers for one server for example a.root-servers.net is handled by many servers at different places. Now there is a technology called as Anycasting that plays a major role in achieving this distributed architecture of DNS root servers.

Anycasting:

Anycasting makes multiple servers in different locations to share a single IP address.

Whenever a request is send to an anycast IP address, then networking routers will route that request to the nearest server possible. This means if i want to reach f.root-servers.net from India the nearest possible location is Chennai (which is shown in the map), rather than reaching some other location in the world. This is the reason why DNS root servers rely heavily on IP anycasting technology.

Some advantages of anycasting are:

  • High speed and low latency
  • Anycasting is Resilient. Because even if the f.root-serves.net in Chennai goes down, the network will take me to the next nearest location in the map.
  • Strong protection against biggest DDOS attacks.

Name Servers:

Name servers maintain information about Domain trees. They contain authoritative information about one or more domains. They respond to queries about those Domains.

Also forward queries about other domains.

Resolver

Resolvers are client programs that generate queris. They also send those queries to appropriate DNS Server.

DNS Server caching

Cache servers store requested IP addresses and host names. Cache entry has a Time-to-Live (TTL) value.

TTL is specified by the admins of the authoritative DNS server.

Recursive query

Whenever a client sends out a resolution request, DNS server takes full responsibility for that request.

If the DNS server has the information, it replies immediately.

If the DNS server does have the information it will forward the query to other DNS servers (root DNS servers) to resolve

Port: 53

How DNS works ?

https://jefferyland.wordpress.com/2011/07/28/quick-review-of-flushdns-registerdns-and-dns-queries/

Documentation taken from here:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/ipconfig.mspx?mfr=true

http://technet.microsoft.com/en-us/library/cc961411.aspx

————–

mDNS

When an mDNS client needs to resolve a host name, it sends an IP multicast query message that asks the host having that name to identify itself. That target machine then multicasts a message that includes its IP address. All machines in that subnet can then use that information to update their mDNS caches.

————–

DNS Round Robin

https://theamvj.wordpress.com/2016/05/25/dns-a-record-setup-with-round-robin/

————–

Zones:

DNS Records

  • A record: Address record. Returns 32bit IP address. Commonly used to map hostnames to IP address.
  • AAAA record: IP v6 address record. Returns 128 bit IPv6 address.
  • CNAME record: Canonical / Alias name.
  • PTR record: Pointer record. Contains IP address to name mappings.
  • TXT record: Contains human readable information. Like comments in a programming code.
  • SOA record.

SOA Record: Start of Authority

  • The SOA record has core information about your zone.
  • It defines which server is your primary nameserver, your contact information (E-mail), how your secondary nameservers get updated, and the default (minimum) Time-To-Live values for your records.
  • To check SOA details, Expand Forward lookup zones -> Right click the domain -> Select properties -> Click Start of Authority (SOA)

soa

 

 

Use of PTR record:

  • Reverse DNS is needed by mail servers in order to detect SPAM.
  • IP address will bring name of the machine in NSlookup, Telnet commands etc.

———

Types of DNS queries

  • Recursive queries
  • Non-Recursive or Iterative queries
  • Inverse Queries

Recursive Query

A recursive query is a kind of query, in which the DNS server, who received your query will do all the job of fetching the answer, and giving it back to you. During this process, the DNS server might also query other DNS server’s in the internet on your behalf, for the answer.

Non-Recursive / Iterative query

In an iterative query, the name server, will not go and fetch the complete answer for your query, but will give back a referral to other DNS server’s, which might have the answer.

Inverse query

Inverse DNS Queries (Reverse DNS Queries) are used when the user wants to resolve the IP Address to a Fully Qualified Domain Name. In other words, the user has the IP address and he wants to find out the Fully Qualified Domain Name corresponding to that IP Address. For Inverse name resolution (Reverse name resolution), Pointer (PTR) records are used. Pointer (PTR) records added to the in-addr.arpa domain. PTR (Pointer) Resource Records must be added in local DNS Server for Inverse Name Resolution to work properly.

Risks associated with Recursive DNS queries

Recursive DNS query risks

A DNS server that supports recursive resolution is vulnerable to DOS (denial of service) attacks, DNS cache poisoning, unauthorized use of resources, and root name server performance degradation.

DOS attacks
Servers supporting recursive DNS queries are vulnerable to phony requests that flood a particular IP address with the results of each server’s query. This can overwhelm the IP address with a volume of traffic too large to be processed.
DNS cache poisoning
Cache poisoning results from someone tricking a DNS server into believing that a fake DNS query response is authentic. Because responses are normally cached, this false information can be distributed to users of that server.
Unauthorized use of resources
With recursive DNS queries enabled, a server is more easily hijacked and its performance compromised.
Root name server performance degradation
When DNS servers are not configured correctly, queries using RFC1918 addressing (also known as “private” addressing) may be leaked to the root name servers, causing a degradation in service for legitimate queries to those servers.

Steps to disable Recursive queries in Windows DNS:

 

  • From the Start menu, click Control Panel, Administrative Tools, then DNS.
  • In the console tree, right-click the appropriate DNS server, and then click Properties.
  • Click the Advanced tab.
  • Under Server options, check Disable recursion, and then click OK.
  • In the console tree, right-click the appropriate DNS server, and then click Clear Cache.

 

http://www.slashroot.in/difference-between-iterative-and-recursive-dns-query

http://www.omnisecu.com/tcpip/what-is-inverse-reverse-dns-query.php

https://in.godaddy.com/help/what-risks-are-associated-with-recursive-dns-queries-1184

———-

DNS

 

 

Active directory – Integrated DNS:

AD Integrated DNS means AD server has DNS role.

DNS Zone transfer is taken care by AD replication. So no separate DNS replication is needed. This is needed if DNS is not an AD server.

Stub Zone:

Stub zone is used to resolve names between different DNS namespaces. A stub zone is a copy of a zone that contains only resource records that are necessary to identify the authoritative DNS servers for that zone.

In easy English: A Stub Zone is just a pointer. It tells one DNS server where to find another DNS server that has the information it is looking for. Delegated zones and conditional forwarders also used to point one DNS server to other DNS server but only Stub Zone dynamically update themselves.

  • Introduced in Windows 2003 server.
  • There are two types of Stub zone: Standard and AD-Integrated Stub zone.
  • Stub zone is a forward lookup zone. We create Stub zone in Forward lookup zone only.
  • Stub zone is read only.
  • Stub zone is good if you have more than one forest.
  • Stub zone dynamically update themselves. What dynamic means ? If you add new name server on the other DNS, it will be automatically reflected in the Stub zone.
  • Zone transfer occurs every 15 minutes by default. You can also manually do it by right clicking the Stub zone -> Select -> Transfer from Master

What Stub zone is not:

  • Stub zone is not a replacement to Secondary zone
  • Stub zone does not provide redundancy
  • Stub zone does not have load sharing

Stub zone consists of:

  • Start of Authority (SOA) record
  • Name server (NS) record
  • A record

 

Delegating DNS Zones

DNS provides option to divide namespace into one or more zones.

Advantages:

  • To distribute traffic among multiple servers.
  • Fault tolerance.

Dynamic DNS

Dynamic DNS is a system that addresses the problem of rapid updates.

End users of Internet access receive an allocation of IP addresses, often only a single address, by their Internet service provider. The assigned addresses may either be fixed (or static), or may change from time to time, a situation called dynamic. Dynamic addresses are generally given only to residential customers and small businesses, as most enterprises specifically require static addresses.

WINS DNS
Windows Internet Name service Domain Naming system
Microsoft’s only (Platform dependent) for DHCP system Name resolution Platform independent for Static IP systems
Resolves NetBIOS to IP and NOT vice-versa Name to IP and vice-versa

WINS is to NetBIOS (Network Basic Input/Output System) names what DNS is to domain names

Today, DNS has replaced WINS, since Microsoft made changes to NetBIOS, allowing it to use the TCP/IP stack to perform its job (NetBIOS over TCP/IP) and most DNS servers are able to handle NetBIOS requests. This is why WINS servers are becoming lesser day by day.

http://searchnetworking.techtarget.com/answer/What-is-difference-between-a-WINS-server-and-a-DNS-server

——-

DNS

Primary zone

When a zone that this DNS server hosts is a primary zone, the DNS server is the primary source for information about this zone, and it stores the master copy of zone data in a local file or in AD DS. When the zone is stored in a file, by default the primary zone file is named zone_name.dns and it is located in the %windir%\System32\Dns folder on the server.

Secondary zone

When a zone that this DNS server hosts is a secondary zone, this DNS server is a secondary source for information about this zone. The zone at this server must be obtained from another remote DNS server computer that also hosts the zone. This DNS server must have network access to the remote DNS server that supplies this server with updated information about the zone. Because a secondary zone is merely a copy of a primary zone that is hosted on another server, it cannot be stored in AD DS.

Stub zones

DNS supports a type of zone called a stub zone. A stub zone is a copy of a zone that contains only those resource records that are necessary to identify the authoritative DNS servers for that zone. A stub zone keeps a DNS server that hosts a parent zone updated with the authoritative DNS servers for its child zone. This helps maintain DNS name resolution efficiency.


Forwarders and Conditional Forwarders

 

Forwarders:

Usually a forwarder is used when you want your clients to have access to internet. Forwarder contains nothing but DNS entries.

  • A forwarder forwards all external (internet) dns queries to another dns server
  • A Forwarder can contain a DNS entry of ISP’s (Internet Service Provider) on your internal DNS server so that the clients can access internet – as shown in the below picture 1.
  • If your Business Unit has it own DNS then its Forwarder can contain DNS of your corporate DNS. The corporate DNS will inturn contain the ISP’s (Internet Service Provider) DNS – As shown in the below picture 2.

Here it can be two ways:

(from ITFreeTraining.com youtube channel)

dns-forwarding-1 dns-forwarding-2

(from ITFreeTraining.com youtube channel)

Steps to configure Conditional forwarder in Windows 2008 (from ITFreeTraining.com youtube channel)

Conditional forwarders

A conditional forwarder is needed suppose if our company acquire another company or Business Unit merged with another Business unit within the same company and want to have the host names able to resolve.

A conditional forwarder checks the query first and depending on the requested domain he sends it to another server or resolves it himself

Forwarder is basically used to access internet (resolve public websites) while conditional forwarder is for resolving Intranet that are not accessible through the ISP’s DNS. Inside a company there they will have Business units with their dedicated DNS for their AD environment. This environment will have lot of hosts that cannot be resolved through ISP’s DNS. Since they would not have those entries. So Conditional forwarder is the only way to resolve these hosts.

using a forwarder, you can manage name resolution for names that are outside your network, such as names on the Internet or names in other forests or domains.

dns-forwarding-3

Automatically remove stale records

Aging and scavenging together provide a mechanism for removing stale resource records. These resource records can accumulate in Domain Name System (DNS) zone data over time when computers permanently leave the network. For example, if a computer registers its host (A) resource record at startup and is later disconnected from the network, its host (A) resource record might not be deleted. If your network has mobile users and computers, this situation can occur frequently.

DNS Commands

ipconfig /flushdns

Removes (flushes) the DNS cache from the machine.

What is the use of this command ?

Removes the DNS cache data from the system. The use is, old or stale DNS cache entries will be removed and if the system needs to resolve any name, it will try to fetch the data from a DNS server.

ipconfig /registerdns

Manually initiate dynamic registration for the DNS names and IP addresses configured at a computer. This option can assist in troubleshooting a failed DNS name registration or in resolving a dynamic update problem between a client and the DNS server without restarting the client.

In other words, you use this command if  the client system name is not being resolved.

ipconfig /displaydns

Shows the content of the DNS cache of the system.

ipconfig /displaydns > “c:\dns-cache-details.txt”

This command is used to export the DNS cache to a text file.

——————

DNS location:

%windir%\System32\DNS\ZoneName.DNS

——————

Difference between Authoritative and Recursive DNS Nameservers?

DNS Suffix

——————

DNS Root Hints

When the DNS Server service is running on a domain controller, root hints are read from Active Directory first. If the DNS Server service is not running on a domain controller or no root hints exist in Active Directory, root hints are implemented using a file, CACHE.DNS, stored in the systemroot\System32\Dns folder on the server computer. This file normally contains the name server (NS) and address (A, AAAA) resource records for the Internet root servers.

——————

Memory usage:

Approximately 4 megabytes (MB) of RAM is used when the DNS server is started without any zones.

If a zone containing 1000 resource records is added to a server, it requires approximately 100 kilobytes (KB) of server memory.

——————

Microsoft DNS full guide:

https://technet.microsoft.com/en-us/library/cc730921.aspx

——————–

Some of the texts copied from and for more details:

http://www.slashroot.in/dns-root-servers-most-critical-infrastructure-internet

Also from quora.com

Also from itfreetraining.com (youtube) videos

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s