Named Servers

[Nathan Guidry]

Do you have to put in a forwarder in Win2K DNS to resolve names not listed
in cache? Can you set it up so that instead of using a forwarder, for DNS
to query the Root Named Servers.

 

[Charles Blair]

By default the DNS server uses the root name servers for resolution.

Check your DNS server properties on the root hints tab.

If it is empty, then you need to verify the System32\DNS\CACHE.DNS file
exists or enter them manually.

Charles

 

[Herb Martin]

Do you have to put in a forwarder in Win2K DNS to resolve names not listed

in cache? Can you set it up so that instead of using a forwarder, for DNS
to query the Root Named Servers.

That's correct -- you are NOT REQUIRED to use forwarders unless you
have one (or more) of the following issues.

Forwarders are need when:

1) You need to resolve more than one DNS "namespace" (DNS hierarchy)
like an internal NameSpace AND the Internet
2) Your internal DNS server cannot pass a firewall or are not allowed to
do
so due to security policies
3) Improve performance and/or protect bandwidth consumption across a
WAN

The first two REQUIRE a forwarder, the last is a "nice to have".

 

[Herb Martin]

Ok, I checked the cache.dns file and it's empty, where do I find the IP
address of the Root Name Servers?

The root can be queried through NSLookup like any
other zone (if you know a WORKING dns server) but
you might not have anything working so here is what I
get right now:

(Below is a "." (dot) after "NS" and before the DNS server to query)
C:\>nslookup -q=NS . 198.32.64.12

(root) nameserver = M.ROOT-SERVERS.NET
(root) nameserver = I.ROOT-SERVERS.NET
(root) nameserver = E.ROOT-SERVERS.NET
(root) nameserver = D.ROOT-SERVERS.NET
(root) nameserver = A.ROOT-SERVERS.NET
(root) nameserver = H.ROOT-SERVERS.NET
(root) nameserver = C.ROOT-SERVERS.NET
(root) nameserver = G.ROOT-SERVERS.NET
(root) nameserver = F.ROOT-SERVERS.NET
(root) nameserver = B.ROOT-SERVERS.NET
(root) nameserver = J.ROOT-SERVERS.NET
(root) nameserver = K.ROOT-SERVERS.NET
(root) nameserver = L.ROOT-SERVERS.NET
M.ROOT-SERVERS.NET internet address = 202.12.27.33
I.ROOT-SERVERS.NET internet address = 192.36.148.17
E.ROOT-SERVERS.NET internet address = 192.203.230.10
D.ROOT-SERVERS.NET internet address = 128.8.10.90
A.ROOT-SERVERS.NET internet address = 198.41.0.4
H.ROOT-SERVERS.NET internet address = 128.63.2.53
C.ROOT-SERVERS.NET internet address = 192.33.4.12
G.ROOT-SERVERS.NET internet address = 192.112.36.4
F.ROOT-SERVERS.NET internet address = 192.5.5.241
B.ROOT-SERVERS.NET internet address = 128.9.0.107
J.ROOT-SERVERS.NET internet address = 192.58.128.30
K.ROOT-SERVERS.NET internet address = 193.0.14.129
L.ROOT-SERVERS.NET internet address = 198.32.64.12

 

[Jonathan de Boyne Pollard]

NG> Ok, I checked the cache.dns file and it's empty, [...]

<URL:http://homepages.tesco.net./~J.deBo...ting-resolving-proxy-root-list.html#Microsoft>

 

[Ace Fekay [MVP]]

In

Ok, tell us how to resolve more than one namespace without using
a forwarder?

(By the way, I didn't mention "split horizon" -- I said multiple
NAMESPACES.)

"Split horizon" does not equal "Multiple Namespaces" -- some
split horizon internal DNS systems are connected to the main,
e.g, Internet namespace, some are not.

In respect to INternet records, Root Hints will work just fine, but
forwarders will be more efficient, so I agree with Jonathan with this.

If intercompany, then forwarders are just one means of doing this. You can
delegate to a child, and forward back to the parent, or use Root HInts (more
tedious) or just have secondary copies of the parent and other child domains
(if there are) in each other;s DNS servers.


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Herb Martin]

In respect to INternet records, Root Hints will work just fine, but

forwarders will be more efficient, so I agree with Jonathan with this.

When one runs a private namespace Forwarders
are required.

Perhaps you, like Jonathon, are confused about the meaning
of "name space" versus merely a split DNS or shadow DNS
setup.

They are different terms -- although when running a separate
namespace you may also be shawowing a Zone from another
namespace.

 

[Herb Martin]

That article is about private namespace design.

Searching for private in that article -- the word doesn't
even appear. It's about Zone and child zone design.

Herb, Forwarding is not "required". There is no where in the AD cookbook, AD
FAQs or anywhere else saying that it's required, but rather "Recommended". I
know that I would always using forwarding, but it's not "Required".

You can say this all you wish, BUT you cannot give a built-in
way to use TWO NAMESPACES without a forwarder.

Now until you can do that you might just want to research
the problem.

Two namespaces require a forwarder because a single DNS
server can only check ONE ROOT and the namespace
it anchors. Clients only query one server (the one that responds
to them.)

To query another namespace you MUST use a forwarder
that is attached to the second namespace through another
root.

It's just logic if you understand the phrase "namespace" and
think it through. My guess is you misunderstand this term
"namespace" (which isn't that big a deal.)

Now we can build a "programmatic" solution but that is
essentially pre-built by "forwarders".

 

[Ace Fekay [MVP]]

In
It's implied.

Searching for private in that article -- the word doesn't
even appear. It's about Zone and child zone design.


You can say this all you wish, BUT you cannot give a built-in
way to use TWO NAMESPACES without a forwarder.

Now until you can do that you might just want to research
the problem.

Two namespaces require a forwarder because a single DNS
server can only check ONE ROOT and the namespace
it anchors. Clients only query one server (the one that responds
to them.)

You can have mutliple namespaces even based on the same root name.
domain.com
child.domain.com
They can both exist on the same DNS server. I've already seen it working
that way. No problem.

To query another namespace you MUST use a forwarder
that is attached to the second namespace through another
root.

I already gave you an example of an infrastructure working with two
namespaces under one server with the same root WITHOUT FORWARDERS Herb.

Test it yourself.

It's just logic if you understand the phrase "namespace" and
think it through. My guess is you misunderstand this term
"namespace" (which isn't that big a deal.)

No, I'm not misunderstanding anything. You're just pushing forwarders. I
already gave you a working example.

Now we can build a "programmatic" solution but that is
essentially pre-built by "forwarders".

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Herb Martin]

You can have mutliple namespaces even based on the same root name.

domain.com child.domain.com

As I thought you misunderstand the word namespace.

It's a common enough mistake.

They can both exist on the same DNS server. I've already seen it working
that way. No problem.

Those are ZONES, or DNS trees, not namespaces.

 

[Jonathan de Boyne Pollard]

JdeBP> Untrue. Forwarding is _not_ required when one has "split
JdeBP> horizon" DNS service. Having conditional forwarders is
JdeBP> but one way of configuring a "split horizon" DNS service,
JdeBP> and not even the best at that. Another way is to have
JdeBP> stub zones.

HM> Ok, tell us how to resolve more than one namespace without
HM> using a forwarder?

Use stub zones, as I said, to override the delegations in the DNS database.

HM> "Split horizon" does not equal "Multiple Namespaces"

"Split horizon" DNS service is the only case where the idea of multiple
namespaces actually has meaning. Every entity only ever sees one DNS
namespace. That's the way that DNS works. "Split horizon" DNS service is
where different entities see different namespaces.

 

[Jonathan de Boyne Pollard]

HM> you cannot give a built-in way to use
HM> TWO NAMESPACES without a forwarder.

Neither he nor you can give a way to use two namespaces _with_ forwarding,
either. There's no way to use two namespaces, full stop. As I said, (and
with the given that we are restricting the discussion to the "IN" class) every
entity making use of DNS sees exactly _one_ DNS namespace.

HM> Two namespaces require a forwarder because a single DNS server
HM> can only check ONE ROOT and the namespace it anchors. Clients
HM> only query one server (the one that responds to them.) To query
HM> another namespace you MUST use a forwarder that is attached to
HM> the second namespace through another root.

The notion here of querying a second DNS namespace simply makes no sense. The
only way that one re-combines data sources in DNS, overriding what the
delegations do, is by picking some point in the namespace tree and specifying
that for all domain names on one side of that point data are fetched from the
public DNS database and that for the other domain names data are fetched from
a private DNS database. This doesn't provide two namespaces. The DNS
database content that one "sees" may comprise private and public content
obtained from many sources stiched together in a complex patchwork, but
there's still just the one namespace for the owner names of the resource
records.

 

[Ace Fekay [MVP]]

In

As I thought you misunderstand the word namespace.

It's a common enough mistake.


Those are ZONES, or DNS trees, not namespaces.

Ah, but a tree is a namespace Herb. So I'm not sure what you're trying to
get at. This thread has veered off the original topic for the original
poster. I thought we're here to help the posters? So what I did I figured I
would look this up so we BOTH know, and anyone else reading this post, what
a Domain Name Space is, so I picked up my old faithfull DNS and BIND, that
is if you trust O'reilly's DNS and BIND, but I remember from a previous post
a few months ago that you don't. That was in a conversation with William
that was left at a standstill. Well, anyway, nonetheless, and to put an end
to this thread, i pulled my sleeves up and blew the dust off the book and
dug in. Well, here it is...

Domain name space (from O'Reilly's DNS and BIND):

"Each unit of data in DNS's distrtibuted database is indexed by a name.
These names are essentially just paths in a large inverted tree, called the
'Domain Name Space'."

So in essence, a tree is a namespace, whether in a private scenario, such as
a company's inner structure, that has nothing to do with the Internet Name
Space, or in the Internet Name Space, called the Root, both represented by
the familiar ".". So the Root in the Internet Name Space really has nothing
to do with a private Name Space, whether a split DNS or not, since a private
Name Space is just that, private. They can have their own Tree or Name
Space.

The definition goes on....
"The tree's hierarchical structure is very similar to the structure of the
Unix file system. The tree has a single root at the top. In Unix, this is
called the Root Directory, represented by a "/", where in DNS it's the ".".,
which is tree's single root at the top. This is called the Root or The Root
Domain. Like a filesystem, DNS's tree can branch any n umber of ways at each
intersection point, called a "node". The depth of the tree is limited to 127
levels (a limit that you're not likely to run into."

One subnote of interest about Sun's NIS is not to confuse domains in DNS
with domains in Sun's NIS.
Though an NIS domains also refers to a gour of hosts (just as in AD, since
they are both X.500 Directory Services and use DNS for their hierarchy),
both types of domains have similaraly structured names, the convcepts are
different. NIS uses hierarchical names but the hierarchy ends there: host in
the same NIS domain share certain data about hosts and users, but they can't
navigate the NIS name space to find data in other NIS domains. So therefore,
either a forwarder or a in same name scenarios (Split Name Space), a shadow
zone or secondaries can be used.

"In abstract, a domain is just a subtree of the domain name space. But if a
domain is just made up of domain names and other domains, where are all the
hosts? Domains are groups of hosts, right? The hosts are domains too. So
domains are just indexed into the DNS database. "

"Delegation provides decentralized administration of the Domain Name
Space."... "We can delegate a portion of the Name Space (the tree in
respects to AD or NIS, or in the Internet Name Space). A domain can have
several subdomains" ... "For example, the Acme Corporation (they supply a
certain coyote with most of his gadgets), which has a division in Rockaway
and it's headquarters in Kalamazoo, might have a rockaway.acme.com subdomain
and a kalamazoo.,acme.com subdomain. However, the few hosts in the Acme
sales office would fit better under the acme.com then under either
subdomain."

So in summary, no where in DNS and BIND does it say Forwarders are REQUIRED.

Matter of fact, on page 332, it says, "The downfall of a forwarder is a
single point of failure". So if we delegated, and forwarded back up to the
Root or parent, and it's down, then we can have a failure. If we make a
secondary copy of the zone in the delegated DNS server, that will overcome
that.

And yes, the delegated zone can be:
child.domain.com
And the DNS server that this exists on that was delegated, can have a
secondary copy of the parent's domain in it, such as:
domain.com. And yes it works, just as I explained.

And yes, domain.com represents the tree in this private scenario, and is the
Domain Name Space in this private hierarchy. And yes, the child.domain.com
zone is part of this namespace. And yes, it is a zone, and yes, it can exist
on the same name server as a separate zone, but yet be part of the same name
space.

That DNS and BIND is a great book! I have to keep the dust off that thing.

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Herb Martin]

Ah, but a tree is a namespace Herb. So I'm not sure what you're trying to

Only if if is a separate tree like you go on to define, with a
root of its own.

When we started this, I made clear that SEPARATE,
distinct namespaces require a forward to resolve in
more than the local namespace.

Please provide a simple method for resolving a SECOND
distinct namespace or give it up.

You can't do it, or you would have by now.

 

[Ace Fekay [MVP]]

In

Only if if is a separate tree like you go on to define, with a
root of its own.

When we started this, I made clear that SEPARATE,
distinct namespaces require a forward to resolve in
more than the local namespace.

Please provide a simple method for resolving a SECOND
distinct namespace or give it up.

You can't do it, or you would have by now.

I said you can use secondaries, and as I pointed out, it was working.

No where does it say forwarders are REQUIRED, but rather HIGHLY recommended.
That was my original point, but you ranted on and ignored it.


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Ace Fekay [MVP]]

In

Where does "it" say? How do YOU say you can
use a secondary as a generaly solution to multiple
name spaces searching?

If the secondary searches the public namespace it
cannot search the main/private namespace fully.

It does'nt matter what "it" says, if YOU CANNOT DO IT.

Well Herb, they had it working. I cleaned up the whole infrastructure with
delegation and forwarding.

But you still haven't replied to my question about where it says Forwarding
is *required*.


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Herb Martin]

I am telling you that if you have a separate namespace
and wish to check a second NAMESPACE then you
must use forwarding.

If you have an example architecture for doing it another
way then post it, but start with an internal NAMESPACE,
not just a zone or two -- a full namespace from the root
down.

 

[Herb Martin]

"Split horizon" DNS service is the only case where the idea of multiple

namespaces actually has meaning. Every entity only ever sees one DNS
namespace. That's the way that DNS works. "Split horizon" DNS service is
where different entities see different namespaces.

No, this above incorrect and likely based on a misunderstanding
of the term "namespace".

A split horizon may nor may not be associated with a separate
namespace (e.g., private vs. the Internet namespaces).

First, many split horizon DNS systems are used where the private
copy DNS servers are actually providing direct access to the
public namespace by searching it from the root down.

root--------
/ \ --- \ private DNS

In this situation all names are searched within the public namespace,
with the distinction that the OUTSIDE clients only see a portion of
the companies DNS records for their domain -- but the compannies
machines see the complete (internal plus external) record set for that
domain and of course the Internet public namespace

All names in the private DNS zone are necessarly valid in the public zone
even if some of them are not reachable from the outside. -- in this
example there is not SEPARATE private namespace with it's own
naming rules, root, or hierarchies. There are some private names in
a private version of a shadow zone.

Second, two entirely different namespaces may be completely
separate to the extent they have NO zones NAMES in common
except "." for root. -- there is no shadow zone because the owner
of the private namespace does not provide a subset of any common
zones to the other namespace.

root separte root (separate
namespace)
/ \ / \

No shadowing; presumably this company on the right with it's own
namespace offers no resources to the internet or uses completely
different names (e.g., .Com publicly, and .Local privately.), i.e. they
are in a SEPARATE NAMESPACE.

Of course, there are shades of gray between the two, where the
private namespace hews largely to the Internet public naming rules,
creating parallel name trees.

The discussion is a private NAMESPACE.

A private namespace requires a forwarder to resolve names from
another (e.g., THE Public Internet) namespace.

My discussion of forwarders (rule #1) was always about SEPARATE,
disjoint DNS namespaces.

In fact, namespaces exist that have nothing to do with DNS,
e.g., WINS namespaces.

Microsoft Press Computer Dictionary

http://www.microsoft.com/mspress/products/1031/4th/comd4up6b.asp

namespace
n. A grouping of one or more names that represent individual objects within
the group in a shared computing environment, such as a network. The names
within a namespace are unique, are created according to the same rules, and
can be resolved into a particular identifying item of information, such as
an IP address or a network device. A namespace can be either flat-a single
collection of unique names-or hierarchical, as is the Internet's DNS (Domain
Name System), which is based on a treelike structure that is refined through
successive levels beginning with the root server and the Internet's
top-level domains (.com, .net, .org, and so on). In everyday terms, a
namespace is comparable to a telephone book, in which each name is unique
and resolves to the phone number and address of a particular individual,
business, or other entity.

 

[William Stacey]

Full namespace from the root down? Then I guess your talking about an
Internal root design. And if so, then you know you can't use forwarders or
root hints on the root server as those are disabled when you add the "."
root domain. If you have a true Internal root, then the only way to also
resolve INET names is to use a Proxy and have the clients configured
accordingly. I don't understand your point on Forwarding with an Internal
root. If all your internal DNS servers are forwarding to the internal root
or have their root-hints pointing to the Internal root, then how are you
configuring the forwarders for external rez? If one DNS is forwarding to an
ISP for INET rez, then it can't also forward to the internal root and you
loose the Internal rez unless you also add conditional forwarders (i.e.
forward zones) for each domain name that you need internally and set the
global forwarder(s) to an INET dns server. At that point, why have an
Internal root? What advantage? Just add the internal domain name to the
DNS server (i.e. not internal root) and forward to the ISP for external rez
and/or use root hints. Have the clients point to this dns server and they
get both internal and external rez. Forwarding not required when using
root-hints. If I missed your point, please use an example with domain names
and dns server setup to help give us a clear context.

--wjs

 

[Herb Martin]

root. If all your internal DNS servers are forwarding to the internal
root

or have their root-hints pointing to the Internal root, then how are you
configuring the forwarders for external rez? If one DNS is forwarding to

an

This really isn't that hard, if all your INTERNAL Servers are set to
use the Internal Namespace by pointing at internal root servers this
requires that they use forwarders to check ANOTHER NameSpace
(e.g., The Internet.)

Thus, rule #1 which you guys have gone on so much about:

You need a forwarder if you want to check two distinct namespaces,
e.g., a private namespace and The Internet.