Configuring Name Resolution in Windows Server 2016
By: Shir Hussain Tabesh
Tags: DNS, Information Technology, Windows Server 2016

Contents covered in this summary note:

Configuring Name Resolution in Windows Server 2016

Installation, Configuration and Troubleshooting of DNS Server

Install and configure DNS servers:

Configure forwarders, root hints, recursion, and delegation

Configure forwarders:

Configure root hints:

Configure recursion:

Create and configure DNS zones and records:

Creating and configuring zones:

Creating Zones:

Examining Built-in Resource Records:

Aging and Scavenging:

Time Stamping:

Definitions you need to know:

DNS records:

How to configure a secondary zone:

Installation, Configuration and Troubleshooting of DNS Server

DNS role in windows server 2016, resolves name to IP and vice versa. As far as Active Directory Domain Services — AD DS can’t work without DNS, DNS is installed while installing AD DS. DNS is already configured to its default i.e. Zones and Records are created. But when you install DNS on a server that’s not a Domain Controller, you need to complete its configuration as well.

You need to learn the following skills to implement DNS servers:

Install and configure DNS servers

Create and configure DNS zones and records

Install and configure DNS servers:

Before installing DNS roles, you need to know that there are three name resolution systems in windows: DNS, Link Local Multicast Name Resolution (LLMNR), and NetBIOS. Of these three, DNS is by far the most important because it is the name resolution method used to support Active Directory Domain Services. A DNS infrastructure requires network-wide configuration for both servers and clients. So in workgroup structure, the LLMNR and NetBIOS are used. Generally, NetBIOS and LLMNR are no longer used because DNS can address the name resolution in windows server 16/later versions and the Internet.

However, LLMNR advantages are: requires no configuration and is compatible with IPv6, unlike NetBIOS. Its disadvantages are: first, doesn’t resolve the names of computers running windows server 2003, window XP or any version of windows earlier than windows vista. Second, it cannot be used to resolve the names of computers beyond the local subnet. On the other hand, NetBIOS, or NetBIOS-over-TCP/IP (NetBT or NBT) is an earlier naming and name resolution system used for compatibility with computers running versions of windows earlier than windows Vista. NetBIOS is enabled by default on all windows operating systems. It includes three name resolution methods: broadcasts, WINS, and the Lmhosts file.

NETBIOS BROADCASTS: computers using NetBIOS to resolve a name will send out broadcasts to the local network requesting the owner of that name to respond with its IPv4 address.

WINS: A WINS server is essentially a directory of computer names, such as Client2 and ServerB, and their associated IP addresses. When you configure a network connection with the address of a WINS server, you perform two steps in one. First, you enable the computer to use a WINS server to resolve computer names that cannot be resolved by DNS or LLMNR; and, second, you register the local computer’s name in the directory of the WINS server. An important advantage of WINS over network broadcasts is that it enables NetBIOS name resolution beyond the local subnet.

LMHOSTS FILE: The Lmhosts file is a static, local database file that is stored in the directory %SystemRoot% \System32\Drivers\Etc and that maps specific NetBIOS names to IP addresses. Recording a NetBIOS name and its IP address in the Lmhosts file enables a computer to resolve an IP address for the given NetBIOS name when every other name resolution method has failed. You must manually create the Lmhosts file. For this reason, it is normally used only to resolve the names of remote clients for which no other method of name resolution is available — for example, when no WINS server exists on the network, when the remote client is not registered with a DNS server, and when the client computer is out of broadcast range.

You can enable NetBIOS from the properties of your local area connection: open the properties of IPv4 and click the Advanced button to open the Advanced TCP/IP Settings dialog box. In this dialog box, click the WINS tab.

The other important points to consider before installing DNS role, you should be logged in using the local administrator group, then get the server assigned an IP statically. To install the DNS server role, follow the instructions bellow:

Sign in to the target server as a local administrator. Open Server Manager. In Server Manager, click Manage and then click Add Roles And Features. In the Add Roles And Features Wizard’s Before You Begin page, click Next. On the Select Installation Type page, click Role-Based or Feature-Based Installation, and click Next. On the Select Destination Server page, select the server from the Server Pool list, and click Next. In the Roles list on the Select Server Roles page, select the DNS Server. In the Add Roles And Features Wizard pop-up dialog box, click Add Features, and then click Next. On the Select features page, click Next. On the DNS Server page, click Next. On the Confirm Installation Selections page, click Install. When the installation is complete, click Close.

Now that installation is completed, you need to configure it.

Configure forwarders, root hints, recursion, and delegation

Configure forwarders:

DNS forwarding enables you to define what happens to a DNS query when the petitioned DNS server is unable to resolve that DNS query. With DNS forwarding you can: first, when a DNS server has no answer for a query, configure it to forward the query to another DNS server. Second, you can define conditional forwarding. You can define specific queries i.e. including some specific domains to forward such queries to specific DNS servers. For instance, forward all the queries that include kpu.edu.af domain to a specific DNS server. Check both configuration as bellow:

First, to configure forwarding, use the following procedure:

In Server Manager, click Tools, and then click DNS. In DNS Manager, right-click the DNS server in the navigation pane and click Properties. In the Server Properties dialog box, on the Forwarders tab, click Edit. In the IP Address list located in the Edit Forwarders dialog box, enter the IP address of the server to which you want to forward all DNS queries, and then click OK. You can configure several DNS servers here; those servers are petitioned in preference order. You can also set a timeout value, in seconds, after which the query is timed out. In the Server Properties dialog box on the Forwarders tab you can view and edit the list of DNS forwarders. You can also determine what happens when no DNS forwarders can be contacted. By default, when forwarders cannot be contacted, root hints are used. Root hints are discussed in the next section. Click OK to complete configuration.

Second, to enable and configure conditional forwarding, use the following procedure:

In DNS Manager, right-click the Conditional Forwarders node in the navigation pane, and then click New Conditional Forwarder. On the New Conditional Forwarder dialog box, in the DNS Domain box, type the domain name for which you want to create a conditional forward. Next, in the IP address of the master servers list, enter the IP address of the server to use as a forwarder for this domain; press Enter. Optionally, specify the Number of Seconds Before Forward Queries Time Out value. The default value is 5 seconds. Click OK.

Configure root hints:

If you do not specify DNS forwarding, then when a petitioned DNS server is unable to satisfy a DNS query, it uses root hints to determine how to resolve it. Root hints are used by DNS servers to enable them to navigate the DNS hierarchy on the Internet, starting at the root. Such query can be iterative or recursive. Local DNS server forward the query to root DNS server, then to TLD DNS server and authoritative DNS server.

By default, the DNS Server service implements root hints by using a file, CACHE.DNS, that is stored in the %systemroot%\System32\dns folder on the server computer.

You can edit the root hints using DNS Manager, use the following procedure:

In Server Manager, click Tools, and then click DNS. In the DNS Manager console, locate the appropriate DNS server. Right-click the server and click Properties. In the server Properties dialog box, click the Root Hints tab. You can then add new records, or edit or remove any existing records. You can also click Copy From Server to import the root hints from another online DNS server. Click OK when you have finished editing root hints.

Configure recursion:

Recursion is the name resolution process when a petitioned DNS server queries other DNS servers to resolve a DNS query on behalf of a requesting client. The petitioned server then returns the answer to the DNS client. By default, all DNS servers perform recursive queries on behalf of their DNS clients and other DNS servers that have forwarded DNS client queries to them.

However, since malicious people can use recursion as a means to attempt a denial of service attack on your DNS servers, you should consider disabling recursion on any DNS server in your network that is not intended to receive recursive queries. To disable recursion, use the following procedure:

From Server Manager, click Tools, and then click DNS. In the DNS Manager console, right-click the appropriate server, and then click Proper- ties. Click the Advanced tab, and then in the Server options list, select the Disable Recursion (Also Disables Forwarders) check box and then click OK.

While it might seem like a good idea to disable recursion, there are servers that must perform recursion for their clients and other DNS servers. However, these are still at risk from malicious network attacks. Windows Server 2016 supports a feature known as recursion scopes, which allow you to control recursive query behavior. To do this, you must use DNS Server Policies.

Create and configure DNS zones and records:

Zones are the databases in which DNS data is stored. A DNS zone infrastructure essentially consists of the various servers and hosted zones that communicate with one another in a way that ensures consistent name resolution.

DNS Zones

Creating and configuring zones:

A zone is a database that contains authoritative information about a portion of the DNS namespace. When you install a DNS server with a domain controller, the DNS zone used to support the Active Directory domain is created automatically. However, if you install a DNS server at any other time, either on a domain controller, domain member server, or standalone server, you have to create and configure zones manually.

Creating Zones:

A DSN zone is a database containing records that associate names with addresses for a defined portion of a DNS namespace.

To create a new zone on a DNS server, you can use the New Zone Wizard in DNS Manager. To launch this wizard, right-click the server icon in the DNS Manager console tree, and then choose New Zone. The New Zone Wizard includes the following configuration pages:

Zone Type

Active Directory Zone Replication Scope

Forward or Reverse Lookup Zone

Zone Name

Dynamic Update

Process for creating a zone

Examining Built-in Resource Records:

When you create a new zone, two types of records required for the zone are automatically created. First, a new zone always includes a Start of Authority (SOA) record that defines basic properties for the zone. All new zones also include at least one NS record signifying the name of the server or servers authoritative for the zone.

Aging and Scavenging:

Aging in DNS refers to the process of using time stamps to track the age of dynamically registered resource records. Scavenging refers to the process of deleting outdated resource records on which time stamps have been placed. Scavenging can occur only when aging is enabled. Together, aging and scavenging provide a mechanism to remove stale resource records, which can accumulate in zone data over time. Both aging and scavenging are disabled by default.

To enable aging for a particular zone, you have to enable this feature both at the server level and at the zone level. To enable aging at the server level, first open the Server Aging/Scavenging Properties dialog box by right-clicking the server icon in the DNS Manager console tree and then choosing Set Aging/Scavenging For All Zones. Next, in the Server Aging/Scavenging Properties dialog box that opens, select the Scavenge Stale Resource Records check box. Although this setting enables aging and scavenging for all new zones at the server level, it does not automatically enable aging or scavenging on existing Active Directory–integrated zones at the server level. To do that, click OK, and then, in the Server Aging/Scavenging Confirmation dialog box that appears, enable the option to apply these settings to existing Active Directory–integrated zones. To enable aging and scavenging at the zone level, open the properties of the zone and then, in the General tab, click Aging, as shown in Figure 3–18. Then, in the Zone Aging/Scavenging Properties dialog box that opens, select the Scavenge Stale Resource Records check box.

Time Stamping:

The DNS server performs aging and scavenging by using time stamp values set on resource records in a zone. Active Directory–integrated zones perform time stamping for dynamically registered records by default, even before aging and scavenging are enabled. However, primary standard zones place time stamps on dynamically registered records in the zone only after aging is enabled. Manually created resource records for all zone types are assigned a time stamp of 0; this value indicates that they will not be aged.

Definitions you need to know:

Forwarding DNS: Allows to forward DNS request from one DNS server to another to be resolved.

Active Directory can’t work without DNS.

Conditional Forwarding allows you to set condition on which DNS request gets send to which DNS server.

Primary zone: A primary zone is the main type of DNS zone. A primary zone provides original read-write source data that allows the local DNS server to answer DNS queries authoritatively about a portion of a DNS namespace. When the local DNS server hosts a primary zone, the DNS server is the primary source for information about this zone, and the server stores the master copy of zone data in a local file or in Active Directory Domain Services (AD DS). When the zone is stored in a file instead of Active Directory, by default the primary zone file is named zone_name.dns, and this file is located in the %systemroot%\System32\Dns folder on the server.

Active Directory Integrated Zone: a primary zone stored in Active Directory

Secondary zone: A secondary zone provides an authoritative, read-only copy of a primary zone or another secondary zone. Secondary zones provide a means to offload DNS query traffic in areas of the network where a zone is heavily queried and used. Additionally, if the zone server hosting a primary zone is unavailable, a secondary zone can provide name resolution for the namespace until the primary server becomes available again. The source zones from which secondary zones acquire their information are called masters, and the data copy procedures through which this information is regularly updated are called zone transfers. A master can be a primary zone or other secondary zone. You can specify the master of a secondary zone when the secondary zone is created through the New Zone Wizard. Because a secondary zone is merely a copy of a primary zone that is hosted on another server, it cannot be stored in AD DS.

Stub-zone: A stub zone is similar to a secondary zone, but it contains only those resource ecords necessary to identify the authoritative DNS servers for the master zone. Stub zones are often used to enable a parent zone like proseware.com to keep an updated list of the name servers available in a delegated child zone, such as east.proseware.com. They can also be used to improve name resolution and simplify DNS administration. It contains partial data from another zone. The only records to find an authoritative server. In another words, DNS stub-zones are used to enable your DNS servers to resolve records in another domain. The information in the stub-zone allows your DNS to contact the authoritative DNS server directly.

Active Directory — integrated Zone: When you create a new primary or stub zone on a domain controller, the Zone Type page gives you the option to store the zone in Active Directory. In Active Directory–integrated zones, zone data is automatically replicated through Active Directory in a manner determined by the settings you choose on the Active Directory Zone Replication Scope page. In most cases, this option eliminates the need to configure zone transfers to secondary servers. Integrating your DNS zone with Active Directory has several advantages. First, because Active Directory performs zone replication, you do not need to configure a separate mechanism for DNS zone transfers between primary and secondary servers. Fault tolerance, along with improved performance from the availability of multiple read/write primary servers, is automatically supplied by the presence of multimaster replication on your network. Second, Active Directory allows for single properties of resource records to be updated and replicated among DNS servers. Avoiding the transfer of many and complete resource records decreases the load on network resources during zone transfers. Finally, Active Directory–integrated zones also provide the optional benefit of requiring security for dynamic updates, an option you can configure on the Dynamic Update page.

Standard Zone: By default, on the Zone Type page, the option to store the zone in Active Directory is selected when you are creating the zone on a domain controller. However, you can clear this check box and instead create what is called a standard zone. A standard zone is also the only option for a new zone when you are creating the zone on a server that is not a domain controller; in this case the check box on this page cannot be selected. As opposed to an Active Directory–integrated zone, a standard zone stores its data in a text file on the local DNS server. Also unlike Active Directory–integrated zones, with standard zones, you can configure only a single read-write (primary) copy of zone data. All other copies of the zone (secondary zones) are read-only. The standard zone model implies a single point of failure for the writable version of the zone. If the primary zone is unavailable to the network, no changes to the zone can be made. However, queries for names in the zone can continue uninterrupted as long as secondary zones are available.

The entire DNS tree is called the DNS namespace.

Zones contain a variety of record types called resource records , which contain information about network resources

, which contain information about network resources Configuring Dynamic Update Settings: DNS client computers can register and dynamically update their resource records with a DNS server. By default, DNS clients that are configured with static IP addresses attempt to update host (A or AAAA) and pointer (PTR) records, and DNS clients that are DHCP clients attempt to update only host records. In a workgroup environment, the DHCP server updates the pointer record on behalf of the DHCP client whenever the IP configuration is renewed. For dynamic DNS updates to succeed, the zone in which the client attempts to register or update a record must be configured to accept dynamic updates.

DNS records can be added and changed by:

Static updates — administrator enters DNS record information manually Dynamic updates — referred to as Dynamic DNS (DDNS)

Dynamic updates and Record Security: If you look at the security properties of a resource record, you can see that various users and groups are assigned permissions to the record, just as with any resource in Windows. These security permissions are used for secure dynamic updates. When only secure dynamic updates are allowed in a zone, the user listed as the owner of the resource record (in the advanced security settings) is the only user that can update that record.

DomainDNSzones and ForestDNSzones: A partition is a data structure in Active Directory that distinguishes data for different replication purposes. By default, domain controllers include two application directory partitions reserved for DNS data: DomainDnsZones and ForestDnsZones. The DomainDnsZones partition is replicated among all domain controllers that are also DNS servers in a particular domain, and the ForestDnsZones partition is replicated among all domain controllers that are also DNS servers in every domain in an Active Directory forest.

DNS records:

Host (A): stores the IP address for a name.

Alias (CNAM): alternative record or alias for another record.

Mail Exchange (MX): identifies mail server for DNS name.

Service Record (SRV): location of service on the network.

Name Server (NS): authority DNS server.

Pointer (PTR): proves IP address to name mapping. It’s the opposite of A records. It’s used for reverse lookup zone.

How to configure secondary zone:

For secondary DNS zone, install a new server.

Set its IP putting the primary DNS address as its DNS.

Join it to the domain.

Go to DNS management (Server Manager — Tools — DNS) or for short: Run — dnsmgmt.msc

Install Forward & Reverse Lookup Zones selecting Secondary.

Here you need to know the primary DNS IP address.

Unless you have transferred the zone from the primary DNS, you have no access. So go to the primary DNS and transfer the zone: Right-click on the domain and go to properties — zone transfer. Allow only to the following servers. Edit, then Notify…

Note: this text is a summary of DNS implementation on window server 2016 from ‘Exam Ref 70–741 Networking with Windows Server 2016’