problem

[MaWaaX]

hi guys,

i cant get the client pcs to view the my companies website.

I have set up DHCP and the server as the dns server. I
have enabled DNS forwarding so that the servers IP looks
at the dns servers given to me by our internet providers.

The problem lies here... when i set my dns servers on dhcp
(in this case the servers ip address...) it doesnt allow
the clients to view the company home page. they can browse
anyother page perfectly but not the company web site.

the server is called SERVER.companywebsite.com using
itslef as a dns server....

is this wrong??
if i set any other dns as the dns server for internet
browsing its fine for a while... after a few hours the
same happens again..... but i need to have the server as
the dns server otherwise the clients take way to long to
log on.

this might sound confusing...... but i need help.... i am
happy to clarify

 

[John LeMay]

I have set up DHCP and the server as the dns server. I have enabled DNS
forwarding so that the servers IP looks at the dns servers given to me
by our internet providers.

Why did you do this? I'd start by deleting the forwarders.

The problem lies here... when i set my dns servers on dhcp (in this case
the servers ip address...) it doesnt allow the clients to view the
company home page. they can browse anyother page perfectly but not the
company web site.

the server is called SERVER.companywebsite.com using itslef as a dns
server....

Are you using the same domain name internally (on the AD server) as you
are externally (for the real world)?

If so, where is the web page? I'm guessing it's probably on the ISP's
network someplace. Basically, somewhere besides your local network.

If I've guessed correctly, you should find this information helpful.

If you use the same domain name internally and externally you need to
setup and maintain what is called a "split brain DNS". In other words you
need to maintain a copy of records for any external servers for your
domain - like a web server - on your internal DNS server.

Let's say you have a domain called "xyz.com". Your ISP hosts the public
DNS for the domain and has entries for "www", "mail", and maybe others.
For the outside world everything looks great.

Now you come along with your Windows 2000 machine and make is a DC in
domain "xyz.com". DNS gets configured when you run dcpromo and everything
seems fine. However, your clients (or the server for that matter) - using
the DC as their DNS server - won't be able to resolve "www.xyz.com",
"mail.xyz.com", or anything else that is available to the outside world.

This is because the DC thinks that it is the root server for xyz.com. It
believes that if it doesn't know about a host on xyz.com, it must not
exist. Therefore www and mail are unavailable to any user's pointing to
the DC for DNS services since there are no entries (because you didn't
create them) for these hosts in the dns forward lookup zone for xyz.com.

Many people - myself included way back when - first think that you need to
configure DNS forwarders in order to resolve these hosts (www and mail in
our example). This is NOT what forwarders are for. Forwarders tell the DNS
server to send requests for domains not hosted on that server to the
forwarder's addresses as the next step in the resolution process. The
server will NOT forward requests for any hosts whose domain it is
configured for - in this case xyz.com.

Forwarders make no sense in most scenarios. They are only of use - IMHO -
in large corporate environments where you have several layers of DNS
servers or where you want to use a central DNS server or servers for
caching purposes in order to reduce the amount of traffic going to the
Internet for name resolution purposes (either because of bandwidth or just
for general performance). Forwarding to a DNS server that is on the
Internet already is just plain dumb (go ahead, someone prove me wrong here
and give me a good reason for forwarding to a DNS server that is on the
Internet - and it better not be because you don't know how to open port 53
on your firewall either).

Now, let's get back to fixing your problem - the split brain DNS
configuration I mentioned way back when. The simple answer is to figure
out what the web server's and any other server's public ip address is
(hint - use nslookup or dig) and make entries for these hosts in your
internal DNS (right in the forward lookup zone for your domain - xyz.com
in our example here. This means you will have to maintain these if they change.
However, once you do this your clients will be able to get to the
webserver - again, if I've guessed the issue properly.

--
John LeMay
kc2kth
Senior Technical Manager
NJMC | http://www.njmc.com | Phone 732-557-4848
Specializing in Microsoft and Unix based solutions

 

[mawaax]

you are spot on with the problem.. i shall test this later
thankx a million

 

[John LeMay]

So you may not be one of them, but to make such a harsh bold statement
in a public forum designed to help others is pretty blatant. This is a
forum of discussion and collaboration.

Granted it was harsh, but I really wanted to stir up this topic a bit. I
thought I qualified the statement by indicating that it was my opinion,
but that should have been obvious anyhow.

We are here to help and discuss various solutions for folks with their
problems, not hash out personal choices and why this is best and that is
not.

I disagree. We, the experienced ones, are here to provide "best practices"
advice for those trying to implement for the first time what we can
probably do blindfolded anymore. What better way to do that than in a
forum like this where we present different opinions and argue our points?
I look forward to doing this often with yourself and others here!

There was one other person that argued against the use of them in the
recent pass, but it was only because he was an ISP and didn't want his
customers to forward to their servers. Are you an ISP?

No, I am not. I need to qualify that a bit though. While my company
offers webhosting, we are only a reseller of the services and not the
actual hosting company. I'm also not here necessarily to advertise either!

I actually understand the ISP's point though (check out my other response
in another thread). Why should the ISP want to handle the extra traffic?
Proper DNS, IMHO (qualified that one! <g>), is a cost of doing business
just like any other portion of implementing AD. I know it's a stupid
example, but you wouldn't expect your ISP to handle your print servers,
right?

Deleting the forwarders won't help this gentleman's problems.

Agreed.

--
John LeMay
kc2kth
Senior Technical Manager
NJMC | http://www.njmc.com | Phone 732-557-4848
Specializing in Microsoft and Unix based solutions

 

[Ace Fekay [MVP]]

In

Granted it was harsh, but I really wanted to stir up this topic a
bit. I thought I qualified the statement by indicating that it was my
opinion, but that should have been obvious anyhow.

Agreed it was harsh. It was your opinion, and I'll give you that much.

I disagree. We, the experienced ones, are here to provide "best
practices" advice for those trying to implement for the first time
what we can probably do blindfolded anymore. What better way to do
that than in a forum like this where we present different opinions
and argue our points? I look forward to doing this often with
yourself and others here!

Actually we ARE here to help. That's the purpose of the public MS groups. It
is helpful in some cases to argue out different points of views to give the
reader more perspective in a design, but it could also lead to excessive
confusion. Lengthy discussions can be helpful or harmful to the original
poster, where it may offer insight and extra information on the topic, yet
with some it may lead to much confusion where the original poster does not
know what suggestions to follow and their problem remains.

The consensus is on trying to provide assistance with the least possible
confusion and offer "best practices" to the user, with some examples to
facilitate that. In this case of our discussion, Forwarding, the consensus
here is to use individual forwarding. In a larger environment, the design
will need to be adapted for best performance, WAN efficiency and clean
resolution of all resources throughout the forest. Forwarding in that case
would be highly dependent on the number of domains, WAN links and other
factors, such as delegation and the need to ensure resolution throughout the
forest for AD functionality.

No, I am not. I need to qualify that a bit though. While my company
offers webhosting, we are only a reseller of the services and not the
actual hosting company. I'm also not here necessarily to advertise
either!

Well, that's good to hear you're not trying to advertise. I don't even
supply my private company name in my signature. There is one other here that
does advertise that uses his company as examples, that I feel he's trying to
promote it constantly and it's somewhat annoying.

Hey, I should advertise that one of my German Shepherds (sire and dam AKC
and Prem OFA), just had 9 puppies and I need to sell all of them by the end
of August, but I don't, even though I have an avenue here.

btw- Interested?

I actually understand the ISP's point though (check out my other
response in another thread). Why should the ISP want to handle the
extra traffic?

I have to agree here. I'm a small time ISP, hosting about 25 domains (email,
ftp, etc) but I'm not a carrier, just offering services. If I were offering
access, I would frown on it too.

Proper DNS, IMHO (qualified that one! <g>), is a cost
of doing business just like any other portion of implementing AD. I
know it's a stupid example, but you wouldn't expect your ISP to
handle your print servers, right?


Agreed.

--
John LeMay
kc2kth
Senior Technical Manager
NJMC | http://www.njmc.com | Phone 732-557-4848
Specializing in Microsoft and Unix based solutions

Very good. I look forward to more "discussions" with you. You'll find there
are a few of us here that will take the challenge, but as I stated, we are
here to help.

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Kevin D. Goodknecht Sr. [MVP]]

In Ace Fekay [MVP] <PleaseSubstituteMyFirstName&[email protected]>
posted their concerrns,
Then Kevin D4Dad added his reply at the bottom.
!

Well, that's good to hear you're not trying to advertise. I don't even
supply my private company name in my signature. There is one other
here that does advertise that uses his company as examples, that I
feel he's trying to promote it constantly and it's somewhat annoying.

LOL gee Ace, I wonder who does that?

Oh! I have my link to my website, if I didn't know better you could be
talking about me. (I know you're not) But just for the info, my website is a
hobby, it is only for friends and family for most of those that don't visit
here very often. I never promote it or push it on anybody. I started the web
site a a place to publish my personal web sites. I donate space to one High
School for their JROTC program. The rest are links I use regularly so I want
them on my home page, They are not being promoted by me, just so everybody
knows.

 

[John LeMay]

It is not a statment of opinion when you tell someone to remove
forwarders.

The statement we are referring to is when I called the practice of
forwarding dns requests off one's own network to an internet host instead
of using an onsite DNS server that is readily available dumb. I purposely
overstated my opinion there for the sake of argument.

After discussing this over the past few hours here I'm willing to back
pedal on that statement a bit (but since it was overstated to start
with...). I still don't think the practice delivers any real performance
improvement in any correctly designed environment however.

What extra traffic? If you are paying for internet service from an ISP
you are also paying for the use of their DNS servers. Why should the ISP
care if the DNS request is coming from you DNS server proxied to them or
from the client pointing directly to them.

Typically when a moderate to large organization negotiates with an ISP for
bandwidth they plan on providing their own DNS services within their
organization. The ISP knows this and does not plan on having a few hundred
or more new client stations accessing their DNS servers for every query
(either directly or the same quantity of queries proxied through another
DNS server that is configured with forwarders). ISP's do expect smaller
clients - those with fewer than 30 or so stations - to use their DNS
services.

We haven't really discussed anywhere the differences in expectations on
the part of the client or the ISP based on the size of the client, but it
is an important design factor (as I'm sure you know, I just felt it needed
to be stated here).

I saw that in another thread you recommended using ISP's DNS as
secondary, this is incorrect, doing so even as secondary will cause
request that shouls only go to the DC to go to the ISP's DNS which are
less than 1 in a 1000 to be able to answer. Never do it and never
recommend it unless you know for a fact that the ISP's DNS is able to
support those AD requests. I would not be overstating the fact if I said
that most of the problems in this NG are caused by improper use of an
ISP's DNS in TCP/IP properties.

Suppose we are discussing a small, single DC environment with roughly
20 clients. The clients are Windows 2000 Pro and are joined to the domain.
How would you configure DNS? If you gave each client only the one DNS
server your clients lose all access - internal and Internet - if the DC is
unavailable.

In my scenario - assigning the DC address as primary DNS server and one of the
ISP's servers as secondary DNS server - allows these clients to still have
Internet access if the DC is unavailable. For many small clients this
means that they still have access to email even if they can't access their
file server.

To the best of my knowledge, any AD requests sent to a DNS server that
cannot handle the request are simply discarded by the DNS server. In addition,
hopefully the DC is relatively stable and available to service these
requests the majority of the time limiting the number of "bad" requests
the remote DNS server must deal with.

It would be very boring here if everyone knew when and where not to use
their ISP's DNS servers.

It certainly would be. It would also be equally as boring if everything
about the implementation was simply black and white. I suppose that's why
we discuss "best practices" instead of "best practice" or simply
"practice".

--
John LeMay
kc2kth
Senior Technical Manager
NJMC | http://www.njmc.com | Phone 732-557-4848
Specializing in Microsoft and Unix based solutions

 

[Ace Fekay [MVP]]

In

In Ace Fekay [MVP] <PleaseSubstituteMyFirstName&[email protected]>
posted their concerrns,
Then Kevin D4Dad added his reply at the bottom.
!

LOL gee Ace, I wonder who does that?

Oh! I have my link to my website, if I didn't know better you could be
talking about me. (I know you're not) But just for the info, my
website is a hobby, it is only for friends and family for most of
those that don't visit here very often. I never promote it or push it
on anybody. I started the web site a a place to publish my personal
web sites. I donate space to one High School for their JROTC program.
The rest are links I use regularly so I want them on my home page,
They are not being promoted by me, just so everybody knows.

LOL, no it's not you Kevin!!! Never even considered that!

It's our other friend, without mentioning names, who always uses his domain
as examples in stuff, where we would use "domain.com", etc.

Ace

 

[Kevin D. Goodknecht Sr. [MVP]]

In Ace Fekay [MVP] <PleaseSubstituteMyFirstName&[email protected]>
posted their concerrns,
Then Kevin D4Dad added his reply at the bottom.

In

LOL, no it's not you Kevin!!! Never even considered that!

It's our other friend, without mentioning names, who always uses his
domain as examples in stuff, where we would use "domain.com", etc.

Ace

Ace, I know exactly who you were thinking of, to think about it there are at
least two that point to their own resources. Like they are the ultimate
authority to ask. But I don't let it bother me, I just consider the source
of the criticism.

 

[Ace Fekay [MVP]]

In

I haven't had an ISP complain about our DNS configurations yet, so I
haven't had to cross that bridge personally.

I was also unaware that a client would attempt to register their
address on *all* defined dns servers and at the interval you
indicated. I'll have to read up on that area a bit more!

John, as for the way the Windows DNS Client Resolver Service works, if there
are mutliple DNS addresses listed in the IP properties, the resolver will
query the first one in the list. If the first one comes back with a NULL or
doesn't respond, then it goes to the second one in the list, but it removes
the first one out of the "eligible resolvers list" and never to go back to
it unless you either restart the machine or restart the DNS Client service.
This is of course a behavior that we have to deal with and it's not
efficient to go to each machine if this were the case. There is a reg entry
to alter this behavior that forces it to reset the list after each query.
But that of course is not ideal in any environment to give to all the
machines, especially with 3000 seats.

Here's more info on that:
286834 - The DNS Client Service Does Not Revert to Using the First Server in
the List:
http://support.microsoft.com/?id=286834

As for registration, yes, the netlogon service registers every 60 minutes on
a DC and are refreshed every 24 hours. That was changed in W2k3 to only
every 24 hours. Clients are usually once thru DHCP (is using it) or when you
manually ipconfig /registerdns or at startup with a static client. They all
use the Primary DNS Suffix to know what zone to reg into.

Here's a link on that behavior. This talks about altering the behavior, but
mentions (scroll down to netlogon) about the default registration timing in
W2k.
Q246804 - How to Enable-Disable Windows 2000 Dynamic DNS Registrations
(Default Registration Times are listed here):
http://support.microsoft.com/?id=246804

So you see, "best practice", as we were speaking of in an earlier
discussion, is to ONLY use your internal DNS and Forward (my preference) or
use the Roots (your preference).

Cheers!

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Ace Fekay [MVP]]

In

In Ace Fekay [MVP] <PleaseSubstituteMyFirstName&[email protected]>
posted their concerrns,
Then Kevin D4Dad added his reply at the bottom.

Ace, I know exactly who you were thinking of, to think about it there
are at least two that point to their own resources. Like they are the
ultimate authority to ask. But I don't let it bother me, I just
consider the source of the criticism.

True, I feel the same, and have let it go a long time ago. But sometimes it
comes! I usually just lay down and relax until the thought goes away!

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Kevin D. Goodknecht Sr. [MVP]]

In Ace Fekay [MVP] <PleaseSubstituteMyFirstName&[email protected]>
posted their concerrns,
Then Kevin D4Dad added his reply at the bottom.

As for registration, yes, the netlogon service registers every 60
minutes on a DC and are refreshed every 24 hours. That was changed in
W2k3 to only every 24 hours.

Just to clarify Ace, is it 60 minutes or two hours?
Somehow, I was remembering two hours as the default which can be change
IIRC, if I am incorrect thank you, I will stand corrected and will use the
60 minutes in the future.

 

[Ace Fekay [MVP]]

In

In Ace Fekay [MVP] <PleaseSubstituteMyFirstName&[email protected]>
posted their concerrns,
Then Kevin D4Dad added his reply at the bottom.

Just to clarify Ace, is it 60 minutes or two hours?
Somehow, I was remembering two hours as the default which can be
change IIRC, if I am incorrect thank you, I will stand corrected and
will use the 60 minutes in the future.
--

Yes, it's actually 60 minutes. Check out that link on disabling
regsitration, where it mentions it. Sorry, reading back, I saw you mentioned
2 hours. Didn't realize it until just now. So yes, actually 60 minutes. I
usually remember that from teaching the stuff, but if you remember there's a
error (5781 or 5788?) that pops up every 60 minutes because it's trying to
reg and it can't.

Cheers!

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Jonathan de Boyne Pollard]

KDGS> If you are paying for internet service from an ISP you
KDGS> are also paying for the use of their DNS servers.

Untrue. My ISP, for example, only guarantees to provide me with a service to
"gain acces to the Internet" in its contract. It makes no mention of its even
_having_ DNS servers. My ISP is not unusual in this respect, moreover. Such
terms and conditions are common to many ISPs. Provision of DNS service is not
a given.

 

[Jonathan de Boyne Pollard]

JL> Forwarding to a DNS server that is on the Internet already
JL> is just plain dumb (go ahead, someone prove me wrong here
JL> and give me a good reason for forwarding to a DNS server
JL> that is on the Internet [...]).

One good reason is that forwarding queries, from a forwarding proxy DNS
server, to a resolving proxy DNS server that is _not_ on Internet simply won't
work. Another good reason is that _not_ forwarding, from a proxy DNS server
that itself has no direct IP connectivity to Internet, won't work, also.

Your assertion makes no sense. The fact that a forwardee is "on Internet
already" has no relevance to whether forwarding queries to it is a bad idea.
Is what you wrote truly what you meant ?