5

I wonder if a Windows Domain DNS Server should register any Domain Member in general? I notice that this does not happen if the DHCP is an external system and not aware of the internal DNS Server.

Thanks

3 Answers 3

9

Windows AD DNS usually is updated with all your domain member and network host IP addresses for both - the forward and the reverse lookup zone. There are two mechanisms for updating

In the latter case the DHCP client service (yes, confusing, but this is just how it is implemented) is responsible for sending the DNS dynamic update. The behavior is configurable via group policy settings.

1
  • +1 Your post added clarification to a subject I already understood.
    – Nic
    Feb 6, 2012 at 17:24
6

A lot of things automatically register themselves in an Active Directory environment.

Nearly all of them do it through Dynamic DNS Update.

  • On domain controllers:
    • the netlogon service automatically registers a fair number of srv and a/aaaa resource record sets, so that workstations can find the LDAP, Kerberos, and other services provided by domain controllers.
    • the DNS server service automatically registers a/aaaa resource record sets.
  • On domain controllers, member servers, and workstations:
    • the DHCP client service automatically registers a/aaaa and ptr resource record sets for every network interface where Register this connection's addresses in DNS is enabled. By default it leaves the ptr resource record sets to be registered by the DHCP server, and only attempts to register them itself if the DHCP server does not.
  • On DHCP servers:
    • the DHCP server service automatically registers a/aaaa and ptr resource record sets for every DHCP lease, as long as the DHCP client says to do this (or is a DHCP client that doesn't understand the relevant DHCP options for negotiating who does what registration in the first place).

The problem with "external" DHCP servers is generally not that they don't attempt the registration. Several are capable of this. It's that they speak the wrong protocol for secure Dynamic DNS Update.

Further reading

1
  • Thanks for the very comprehensive answer. That not only answered my question but told me a lot more about the subject! - I nevertheless picked syneticon-dj for the prominent mention of the GPO.
    – Roman
    May 4, 2012 at 9:25
2

I wonder if a Windows Domain DNS Server should register any Domain Member in general?

How long did you think about it?

here is an angle you have mised: How would DNS know all members? Especially of those are not active or moving. Ups - does not work. Simple. DNS never will know all systems around / existing and their IP addresses.

I notice that this does not happen if the DHCP is an external system and not aware of the internal DNS Server.

Yes. Because this is a function of the internal DNS server and it is in general a BAD BAD BAD idea to use an external DNS, exactly for reasons like that. Plus the fact that dynamic DNS updates are something that... are not really used that much outside the MS world.

2
  • I'll argue that dynamic DNS updates are normally used wherever DHCP is used, which most certainly is NOT restricted to Microsoft products. Feb 11, 2012 at 23:50
  • Interesteing enough, though, dynamic DNS updates from the client re1quire integrated security and real time update push to multiple DNS machiens to work properly and guess what - the unix world often muisses the requirements for this. Yes, there are standards, no, most unix ( linux shops are run by people not understanding what sense a central user directory has.
    – TomTom
    Feb 12, 2012 at 5:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .