What is the forward lookup DNS Zone created on a DNS installed on a domain controller ? When I DCPromo`ed the server a zone with the same name of my primary zone but with a _ at the beginning was created on the dns server. Why ? What does it do ? What is it good for ?
2 Answers
Active Directory uses DNS to do a lot of its magic:
Active Directory uses DNS as its domain controller location mechanism and leverages the namespace design of DNS in the design of Active Directory domain names.
I'm not familiar with the specific record you're describing, but AD creates a metric ton of them on a new domain and I don't know them all.
The _msdcs zone that is created hosts AD specific DNS records. All the records that a DC would register are visible in the netlogon.dns file of each DC. See http://support.microsoft.com/kb/816587
Starting with Windows Server 2003 what would have been a subdomain is now hosted as its own zone. Each record has a specific purpose it serves. For example the _ldap._tcp.dc._msdcs.domain.com is used for locating a DC by a client's netlogon service. Its also called a DCLocator record. There are similar records for locating a KDC for kerberos, a GC and also site specific records to request a service from a specific site.
These _msdcs zones and records are critical for AD to function. Please ensure all domain members including DCs always point to one or more DNS servers that host these zones.
