0

I have 3 lab Servers called lab1, lab2, lab3,

My Lab2 is my Windows AD, Windows DNS Server

Lately i don't keep all my servers up as i don't need them all the time so what i did i installed DNS Server role on Lab1 and Lab3 and then did a Zone Transfer from Lab2 to Lab1 and Lab3

Challenge

  1. I am unable to add/edit entries on Lab1 and Lab3.
  2. I am open to alternative of having a DNS Server which i can keep on all the time.

Regards

2
  • 1
    this approach is asking for problems in many ways. First you should only have one zone. Only one of the servers is your StartOfAuthority, and from it, all zone versioning occurs, so the only place you can/should edit the zone is on the primary (SOA) server. The other servers should periodically check the primary servers SOA record version number to determine whether the zone has changed, and refresh the zone from the master. Second, this is just asking for client resolution issues in response to changes. Just leave your domain controller on instead of distributing it in such a small scale. Feb 22, 2016 at 22:21

1 Answer 1

1

DNS Zones are databases of name info on one or more domains. For fault tolerance, load balancing, and resolution performance, a Zone is often hosted on multiple servers, but that comes with a major drawback: how do you maintain the zone consistently on each server that holds it, ensuring that it is always complete, consistent, and correct?

The DNS ecosystem solves this with the idea of Authority. The Original server to hold a zone is that zones Start Of Authority [SOA] and contains its SOA Record. This is the "master" copy of the Zone.

On Microsoft Domain networks, any DNS servers other than the Domain Controller(s) are automatically set as Secondary servers, and if correctly configured will automatically request a zone transfer, but MS behavior aside, any DNS server requesting a DNS Zone Transfer from another server will not be an Authority for that domain, and will recognize the authority of the SOA server on that zone.

When everything is working properly, a secondary (or tertiary, or n-ary) server will periodically check the master servers SOA record, to see if the version number has been incremented, indicating a change in the zone, and will then request another zone transfer (full or partial depending on the configuration and server capabilities) to get the changes. It is important to note however that these changes flow from parent to descendant(s) exclusively, and cannot be reversed under normal run-time circumstances.

So, all this together means that you cannot edit a zone held on a server that is not its SOA. I'm sure you can see how important that is for Internet security. Phishing would be a trivial matter if a local DNS server could be tricked into handing out the wrong IP for a banking site for instance. DNS on the public internet must be propagated world wide, and the zones are stored on servers under thousands of different peoples control.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .