1

Question. I have a Windows AD Domain and there is one part that is a mystery to me: how is the Windows Domain / DNS Server doing lookups for domains outside of the Windows domain?

In a simple home network, DNS request routing is easy to understand:

Generic Example: Client machine -> (defined DNS or from DHCP) -> 
                ->Router / Gateway -> (usually ISP DNS) -> DNS root servers -> Internet
Specific Example: 192.168.1.101 -> 192.168.1.1 -> 8.8.8.8 -> DNS root servers -> Internet

In contrast, the path I currently see for my AD network is this:

Client Machine -> Windows Domain / DNS -> ??????? -> DNS root servers -> Internet

If I check the network settings on my Domain Server, the DNS is set to the alternate DNS server (secondary Domain Server), itself, and the loopback, and nothing else.

My internet works, so somehow the Windows Domain server is smart enough to get DNS info from a server upstream, but where and how is this defined?

2 Answers 2

3

Several ways your DCs could query an external name server:

  1. Root hints
  2. Global forwarders
  3. Explicitly defined stub zones, delegations or conditional forward zones
  4. Settings on your DC's network interface - which you've checked.

I'm going to guess #1 or #2. Your question only includes checking network settings - have you checked the DNS manager on the DCs?

If all the above are blank, there's something unintended going on and you should perhaps track outgoing DNS queries using wireshark.

1
  • 2
    Windows DNS is configured to use the root hint servers by default. Absent any forwarders it will use the root hint servers.
    – joeqwerty
    Sep 27, 2015 at 23:56
0

DNS consists of two quite different parts. One part is responsible for publishing the data, and the other part is responsible for accepting DNS requests from clients and trying to answer those requests by gathering data. DNS servers performing the role of publishing data are often called "authoritative" servers, even though that isn't really a technically correct name. Personally, I prefer the name "DNS content server", but that term is not in very wide use. Servers that accept and answer requests from clients are often called "resolving" servers.

This is actually quite similar to how HTTP servers and HTTP proxies work: HTTP servers publish the data, and HTTP proxies accept requests from clients (browsers) and will contact servers to gather the data the client asked for. A difference between Web browsers and DNS clients is that a DNS client is not capable of contacting content DNS servers by itself. A DNS client has to use a DNS resolving server, while a Web browser is perfectly able to function without a HTTP proxy.

Because DNS information is stored in a hierarchical and distributed way, to answer a single query you'll need information from several DNS content servers, likely located all over the world. When a DNS client wants to know the address of "www.serverfault.com", it can just send that request to a DNS resolving server. That DNS resolving server then has to perform the actual work of contacting DNS servers all over the world.

First, the resolving DNS server sends the entire query to a root server (which is a content DNS server). That root server doesn't have a complete answer, but it does know which DNS content servers have more information about names in the ".com" domain. So the DNS resolver now sends the entire query to one of the ".com" content DNS servers. That server also does not have a complete answer, but it does know which DNS content servers have more information about names in the servervault.com domain. The resolving DNS server will keep asking content DNS servers around the world until it has a complete answer for the client. Of course, the resolving DNS server will cache information along the way: it will not contact the root content DNS servers for each query in a ".com" domain if it knows from its cache where the ".com" content DNS servers are.

A "forwarder" is simply a resolving DNS server that sends client queries to another (preconfigured) resolving DNS server, instead of trying to answer them itself by contacting content DNS servers all over the world. Home routers often contain a resolving DNS server, which is configured to use the resolving DNS server of the ISP as a forwarder.

It can get confusing when the two different roles (both content serving and resolving) come together in one DNS server. This is more or less what happens with Active Directory. In Active Directory, DNS is used to publish information about where certain services can be found. For example, when a client in the domain ad.example.com wants to contact a Kerberos Password Change Server for its domain, it issues a DNS request for a SRV record called _kpasswd._tcp.ad.example.com. This DNS request is sent, just like any other DNS request, to the resolving DNS server configured in the client. The resolving DNS server then goes to work trying to answer the request.

This is where it can get a bit confusing. The DNS resolving server might know that it is part of a specific Active Directory domain, which means it can recognize incoming queries for names in that domain. If the resolver receives such a query, it won't contact outside DNS servers, but it can reply directly with information from the Active Directory database. If an incoming query is not for a name in the domain, the resolver either tries to answer the question itself by contacting content DNS servers, or (in case it is configured to use a forwarder) just sends the query on to another DNS resolving server. This is most likely what happens in your scenario.

What can further confuse matters are dynamic updates. In any non-trivial domain, services are not static. Domain controllers might be added or removed, etc. The same applies to workstations. This means that the information in DNS needs to be updated to reflect this. Dynamic Updates is a protocol that enables a client to modify the information that is published in DNS. A client sends a query to its resolving DNS server to find out to which content DNS server it can send the new information. In case of an Active Directory integrated DNS infrastructure, the resolving DNS server might very well have access to the database itself: in that case the resolving DNS server tells the client that it can update the information itself.

2
  • I appreciate the detailed explanation, but I already knew most of this. What I was wondering is how the Windows DNS Server knows about DNS information outside of its Domain, when there is no place to define a specific upstream DNS server. It appears it does so via root hints.
    – Daniel
    Sep 28, 2015 at 18:58
  • If you're certain that the resolver does not use a forwarder, or in other words: when the resolver does all the hard work of resolving queries by itself, then it needs to know how to find the root servers. This is indeed done by preconfigured root hints. (This differs a bit among DNS server implementations: some use root hints, while others just use a list of root servers.)
    – Jurjen
    Sep 29, 2015 at 6:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .