Understanding DNS Zones

DNS Zones Overview

A DNS zone is the contiguous portion of the DNS domain name space over which a DNS server has authority, or is authoritative. A zone is a portion of a namespace . it is not a domain. A domain is a branch of the DNS namespace. A DNS zone can contain one or more contiguous domains. A DNS server can be authoritative for multiple DNS zones. A noncontiguous namespace cannot be a DNS zone.

A zone contains the resource records for all of the names within the particular zone. Zone files are used if DNS data is not integrated with Active Directory. The zone files contain the DNS database resource records which define the zone. If DNS and Active Directory are integrated, then DNS data is stored in Active Directory.

The different types of zones used in Windows Server 2003 DNS are listed below:

A primary zone is the only zone type that can be edited or updated because the data in the zone is the original source of the data for all domains in the zone. Updates made to the primary zone are made by the DNS server that is authoritative for the specific primary zone. You can also back up data from a primary zone to a secondary zone.

A secondary zone is a read-only copy of the zone that was copied from the master server during zone transfer. In fact, a secondary zone can only be updated through zone transfer.

An Active Directory-integrated zone is a zone that stores its data in Active Directory. DNS zone files are not needed. This type of zone is an authoritative primary zone. Zone data of an Active Directory-integrated zone is replicated during the Active Directory replication process. Active Directory-integrated zones also enjoy the security features of Active Directory.

A reverse lookup zone is an authoritative DNS zone. These zones are mainly used to resolve IP addresses to resource names on the network. A reverse lookup zone can be either of the following zones:

A stub zone is a new Windows Server 2003 feature. Stub zones only contain those resource records necessary to identify the authoritative DNS servers for the master zone. Stub zones therefore contain only a copy of a zone, and are used to resolve recursive queries and iterative queries:

Stub zones contain the following information:

Zone delegation occurs when you assign authority over portions of the DNS namespace to subdomains of the DNS namespace. You should delegate a zone under the following circumstances:

Understanding DNS Zone Transfer

A zone transfer can be defined as the process that occurs to copy the resource records of a zone on the primary DNS server to secondary DNS servers. Zone transfer enables a secondary DNS server to continue handling queries if the primary DNS server fails. A secondary DNS server can also transfer its zone data to other secondary DNS servers, who are beneath it in the DNS hierarchy. In this case, the secondary DNS server is regarded as the master DNS server to the other secondary servers.

The zone transfer methods are:

Understanding DNS Resource Records (RRs)

The DNS database contains resource records (entries) that are used to resolve name resolution queries sent to the DNS server. Each DNS server contains the resource records (RRs) it needs to respond to name resolution queries for the portion of the DNS namespace for which it is authoritative. There are different types of resource records.

A few of the commonly used resource records (RR) and their associated functions are described in the Table.

Resource Records TypeNameFunction
AHost recordContains the IP address of a specific host, and maps the FQDN to this 32-bit IPv4 addresses.
AAAAIPv6 address recordTies a FQDN to an IPv6 128-bit address.
AFSDBAndrews files systemAssociates a DNS domain name to a server subtype: an AFS version 3 volume or an authenticated name server using DCE/NCA
ATMAAsynchronous Transfer Mode addressAssociates a DNS domain name to the ATM address of the atm_address field.
CNAMECanonical Name / Alias nameTies an alias to its associated domain name.
HINFOHost info recordIndicates the CPU and OS type for a particular host.
ISDNISDN info recordTies a FQDN to an associated ISDN telephone number
KEYPublic key resource recordContains the public key for zones that can use DNS Security Extensions (DNSSEC).
MBMailbox name recordMaps the domain mail server name to the mail server.s host name
MGMail group recordTies the domain mailing group to mailbox resource records
MINFOMailbox info recordAssociates a mailbox for an individual that maintains it.
MRMailbox renamed recordMaps an older mailbox name to its new mailbox name.
MXMail exchange recordProvides routing for messages to mail servers and backup servers.
NSName server recordProvides a list of the authoritative servers for a domain. Also provides the authoritative DNS server for delegated subdomains.
NXTNext resource recordIndicates those resource record types that exist for a name. Specifies the resource record in the zone.
OPTOption resource recordA pseudo-resource record which provides extended DNS functionality.
PTRPointer resource recordPoints to a different resource record, and is used for reverse lookups to point to A type resource records.
RTRoute through recordProvides routing information for hosts that do not have a WAN address.
SIGSignature resource recordStores the digital signature for an RR set.
SOAStart of Authority resource recordThis resource record contains zone information for determining the name of the primary DNS server for the zone. The SOA record stores other zone property information, such as version information.
SRVService locator recordUsed by Active directory to locate domain controllers, LDAP servers, and global catalog servers.
TXTText recordMaps a DNS name to descriptive text.
X25X.25 info recordMaps a DNS address to the public switched data network (PSDN) address number.

While there are various resource records that contain different information or data, there are a few required fields that each particular resource record has to contain:

Delegation records and glue records can also be added to a zone. These records are used to delegate a subdomain into a separate zone.

The more important resource records are discussed now. This includes the following:

Start of Authority (SOA) Resource Record

This is the first record in the DNS database file. The SOA record includes information on the zone property information, such as of the primary DNS server for the zone, and version information.

The fields located within the SOA record are listed below:

Name Server (NS) Resource Record

The Name Server (NS) resource record provides a list of the authoritative DNS servers for a domain, as well authoritative DNS server for any delegated subdomains. Each zone must have one (or more) NS resource records at the zone root. The NS resource record indicates the primary and secondary DNS servers for the zone defined in the SOA resource record. This in turn enables other DNS servers to look up names in the domain.

Host (A) Resource Record

The host (A) resource record contains the IP address of a specific host, and maps the FQDN to this 32-bit IPv4 addresses. Host (A) resource records basically associates the domain names of computers (FQDNs) or hosts names to their associated IP addresses. Because a host (A) resource record statically associates a host name to a specific IP address, you can manually add these records to zones if you have machines who have statically assigned IP addresses.

The methods which are used to add host (A) resource records to zones are:

Alias (CNAME) Resource Record

Alias (CNAME) resource records ties an alias name to its associated domain name. Alias (CNAME) resource records are referred to as canonical names. By using canonical names, you can hide network information from the clients who connect to your network. Alias (CNAME) resource records should be used when you have to rename a host that is defined in a host (A) resource record in the identical zone.

Mail exchanger (MX) Resource Record

The mail exchanger (MX) resource record provides routing for messages to mail servers and backup servers. The mail MX resource record provides information on which mail servers processes e-mail for the particular domain name. E-mail applications therefore mostly utilize MX resource records.

A mail exchanger (MX) resource record has the following parameters:

The mail exchanger (MX) resource record enables your DNS server to work with e-mail addresses where no specific mail server is defined. A DNS domain can have multiple MX records. MX resource records can therefore also be used to provide failover to different mail servers when the primary server specified is unavailable. In this case, a server preference value is added to indicate the priority of a server in the list. Lower server preference values specify higher preference.

Pointer (PTR) Resource Record

The pointer (PTR) resource record points to a different resource record, and is used for reverse lookups to point to A resource records. Reverse lookups resolve IP addresses to host names or FQDNs.

You can add PTR resource records to zones through the following methods:

Service (SRV) Resource Records

Service (SRV) resource records are typically used by Active directory to locate domain controllers, LDAP servers, and global catalog servers. The SRV records define the location of specific services in a domain. They associate the location of a service such as a domain controller or global catalog server; with details on how the particular service can be contacted.

The fields of the service (SRV) resource record are explained below:

The Zone Database Files

If you are not using Active Directory-integrated zones, the specific zone database files that are used for zone data are:

Planning DNS Zone Implementations

When you divide the up the DNS namespace, DNS zones are created. Breaking up the namespace into zones enables DNS to more efficiently manage available bandwidth usage, which in turn improves DNS performance.

When determining how to break up the DNS zones, a few considerations you should include are listed below:

The main zone types used in Windows Server 2003 DNS environments are primary zones and Active Directory-integrated zones. The question on whether to implement primary zones or Active Directory-integrated zones; would be determined by the DNS design requirements of your environment.

Both primary zones and secondary zones are standard DNS zones that use zone files. The main difference between primary zones and secondary zones is that primary zones can be updated. Secondary zones contain read-only copies of zone data. A secondary DNS zone can only be updated through DNS zone transfer. Secondary DNS zones are usually implemented to provide fault tolerance for your DNS server environment.

An Active Directory-integrated zone can be defined as an improved version of a primary DNS zone because it can use multi-master replication and the security features of Active Directory. The zone data of Active Directory-integrated zones are stored in Active Directory. Active Directory-integrated zones are authoritative primary zones.

A few advantages that Active Directory-integrated zone implementations have over standard primary zone implementations are:

The mechanism that DNS utilizes to forward a query that one DNS server cannot resolve, to another DNS server is called DNS forwarding. DNS forwarders are the DNS servers used to forward DNS queries for different DNS namespace to those DNS servers who can answer the query. A DNS server is configured as a DNS forwarder when you configure the other DNS servers to direct any unresolved queries to a specific DNS server. Creating DNS forwarders can improve name resolution efficiency.

Windows Server 2003 DNS introduces a new feature, called conditional forwarding. With conditional forwarding, you create conditional forwarders within your environment that will forward DNS queries based on the specific domain names being requested in the query. This differs from DNS forwarders where the standard DNS resolution path to the root was used to resolve the query. A conditional forwarder can only forward queries for domains that are defined in the particular conditional forwarders list. The query is passed to the default DNS forwarder if there are no entries in the forwarders list for the specific domain queried.

When conditional forwarders are configured, the process to resolve domain names is illustrated below:

  1. A client sends a query to the DNS server for name resolution.
  2. The DNS server checks its DNS database file to determine whether it can resolve the query with its zone data.
  3. The DNS server also checks its DNS server cache to resolve the request.
  4. If the DNS server is not configured to use forwarding, the server uses recursion to attempt to resolve the query.
  5. If the DNS server is configured to forward the query for a specific domain name to a DNS forwarder, the DNS server then forwards the query to the IP address of its configured DNS forwarder.

A few considerations for configuring forwarders for your DNS environment are:

How to create a new zone

  1. Click Start, Administrative Tools, and then click DNS to open the DNS console.
  2. Expand the Forward Lookup Zones folder
  3. Select the Forward Lookup Zones folder.
  4. From the Action menu, select New Zone.
  5. The New Zone Wizard initiates.
  6. On the initial page of the Wizard, click Next.
  7. On the Zone Type page, ensure that the Primary Zone. Creates A Copy Of A Zone That Can Be Updated Directly On This Server option is selected. This option is by default selected.
  8. Uncheck the Store The Zone In Active Directory (Available Only If DNS Server Is A Domain Controller) checkbox. Click Next.
  9. On the Zone Name page, enter the correct name for the zone in the Zone Name textbox. Click Next.
  10. On the Zone File page, ensure that the default option, Create A New File With This File Name is selected. Click Next.
  11. On the Dynamic Update page, ensure that the Do Not Allow Dynamic Updates. Dynamic Updates Of Resource Records Are Not Accepted By This Zone. You Must Update These Records Manually option is selected. Click Next.
  12. The Completing The New Zone Wizard page is displayed next.
  13. Click Finish to create the new zone.

How to create subdomains

  1. Click Start, Administrative Tools, and then click DNS to open the DNS console.
  2. In the console tree, select the appropriate zone.
  3. From the Action menu, select New Domain.
  4. The DNS Domain dialog box opens.
  5. Enter the name for new subdomain.
  6. Click OK to create the new subdomain.

How to create a reverse lookup zone

  1. Click Start, Administrative Tools, and the select DNS to open the DNS console.
  2. Select the appropriate DNS server in the console tree.
  3. Right-click the DNS server, and then select New Zone from the shortcut menu.
  4. The New Zone Wizard starts.
  5. Click Next on the first page of the New Zone Wizard.
  6. On the Zone Type page, ensure that the Primary Zone option is selected. Click Next.
  7. On the following page, select the Reverse lookup zone option. Click Next.
  8. Enter the IP network in the Network ID box, for the domain name that you are creating this new reverse lookup zone for. Click Next.
  9. Accept the default zone file name. Click Next.
  10. On the Dynamic Update page, select the Allow both nonsecure and secure dynamic updates option, and then click Next.
  11. .The Completing The New Zone Wizard page is displayed next.
  12. Click Finish to create the new reverse lookup zone.

How to create a stub zone

  1. Click Start, Administrative Tools, and then click DNS to open the DNS console.
  2. Expand the Forward Lookup Zones folder
  3. Select the Forward Lookup Zones folder.
  4. From the Action menu, select New Zone.
  5. The New Zone Wizard initiates.
  6. On the initial page of the Wizard, click Next.
  7. On the Zone Type page, select the Stub Zone option.
  8. Uncheck the Store The Zone In Active Directory (Available Only If DNS Server Is A Domain Controller) checkbox. Click Next.
  9. On the Zone Name page, enter the name for the new stub zone in the Zone Name textbox, and then click Next.
  10. Accept the default setting on the Zone file page. Click Next.
  11. On the Master DNS Servers page, enter the IP address of the master server in the Address text box. Click Next.
  12. On the Completing The New Zone Wizard page, click Finish.

How to add resource records to zones

  1. Click Start, Administrative Tools, and then click DNS to open the DNS console.
  2. In the console tree, select the zone that you want to add resource records to.
  3. From the Action menu, select the resource record type that you want to add to the zone. The options are:
    • New Host (A)
    • New Alias (CNAME)
    • New Mail Exchanger (MX)
    • Other New Records
  4. Select the New Host (A) option.
  5. The New Host dialog box opens.
  6. In the Name (Use Parent Domain Name If Blank) textbox, enter the name of the new host.
  7. When you specify the name of the new host, the resulting FQDN is displayed in the Fully qualified domain name (FQDN) textbox.
  8. In the IP Address box, enter the address for the new host.
  9. If you want to create an associated pointer (PTR) record, enable the checkbox.
  10. Click the Add Host button.
  11. The new host (A) resource record is added to the particular zone.
  12. A message box is displayed, verifying that the new host (A) resource record was successfully created for the zone.
  13. Click OK.
  14. Click Done to close the New Host dialog box.

How to create a zone delegation

  1. Click Start, Administrative Tools, and then select DNS to open the DNS console.
  2. Right-click your subdomain in the console tree, and then select New Delegation from the shortcut menu.
  3. The New Delegation Wizard initiates.
  4. Click Next on the first page of the New Delegation Wizard.
  5. When the Delegated Domain Name page opens, provide a delegated domain name, and then click Next.
  6. On the Name Servers page, click the Add button to provide the names and the IP addresses of your DNS servers that should host the delegation
  7. On the Name Servers page, click Next.
  8. Click Finish.

How to enable dynamic updates for a zone

  • Click Start, Administrative Tools, and the select DNS to open the DNS console.
  • Right-click the zone you want to work with in the console tree, and then select Properties from the shortcut menu.
  • When the Zone Properties dialog box opens, on the General tab, select Yes in the Allow Dynamic Updates list box.
  • Click OK.

    • How to configure a zone to use WINS for name resolution

    You can configure your forward lookup zone to use WINS for name resolution in instances where the queried name is not found in the DNS namespace.

    1. Click Start, Administrative Tools, and the select DNS to open the DNS console.
    2. In the console tree, proceed to expand your DNS server node, and then expand the Forward Lookup Zones folder.
    3. Locate and right-click the zone which you want to configure and then select Properties from the shortcut menu.
    4. When the Zone Properties dialog box opens, click the WINS tab.
    5. Enable the Use WINS Forward Lookup checkbox.
    6. Type the WINS server IP address. Click Add, and then click OK.
    7. On the General tab, select Yes in the Allow Dynamic Updates list box.
    8. Click OK.

    Related Articles on DNS



    Top 5 Free Networking Tools

    Bookmark Understanding DNS Zones

    Latest Blog Posts


    English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
    GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

    Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.