Using BIND for DNS






Using BIND for DNS

Problem

You've decided that you do not want to use Microsoft DNS for Active Directory and instead prefer to use BIND.

Solution

The two main requirements for supporting Active Directory DNS are SRV records and Dynamic DNS support. The first version of BIND to support SRV records was 8.2.2 patch 7. Hopefully you are running a much more recent version since that was released in 2000. You technically don't have to use DDNS with Active Directory DNS records, but if you don't, you end up doing a lot of work to manually maintain the Active Directory-related resource records.

Here is an example BIND 8 configuration to support the ad.rallencorp.com domain:

	Options {
	directory "/etc/namedb";
	};
	Zone "ad.rallencorp.com" IN {
	type master;
	file "db.ad.rallencorp.com";
	allow-update { dc1.; dc2.; dc3.; };
	check-names ignore;
	};

The directory directive specifies where the zone files are stored. The type should be master, and the file directive is the name of the file to store the contents of the zone in. The allow-update directive indicates which servers (either by name or IP address) can dynamically update the zone. Finally, the check-names ignore directive tells BIND not to be restrictive about the names used in resource records. Without this setting, BIND would fail to respond to queries for records containing underscores used by Active Directory.

The BIND 9 configuration for the same zone would look exactly the same, except the check-names ignore line is not necessary. By default, BIND 9 allows underscores in resource records.

After your BIND servers are properly configured, be sure that the resolvers on your domain controllers point to at least one of the BIND name servers. This can be done by going into the Network Connections for each domain controller and right-clicking the active connection. Click on Properties, highlight Internet Protocol (TCP/IP), and select Properties. You can configure the resolvers under the General tab. This setting can also be configured through DHCP or Group Policy.

Discussion

At an absolutely minimum, any DNS implementation used to support Active Directory must be able to publish and resolve queries for Service Locator (SRV) records. For ease of administration it's also useful for dynamic updates to be supported. The most recent versions of BIND DNS support both of these features; however, certain features will still be unavailable to you unless you use Active Directory-integrated DNS that's housed on an AD domain controller. Most notably, this means that BIND DNS does not support secure dynamic updates, which can limit its usefulness in many Active Directory implementations.

See Recipe 14.16 for forcing a domain controller to reregister its records and Recipe 14.14 for verifying that a domain controller can register its records.

BIND documentation and source can be downloaded from the following ISC site: http://www.isc.org/products/BIND.

See Also

Recipe 4.14, Recipe 4.16, MS KB 255913 (Integrating Windows 2000 DNS into an Existing BIND or Windows NT 4.0-Based DNS Namespace), MS KB 323419 (How to Migrate an Existing DNS Infrastructure from a BIND-Based Server to a Windows Server 2003-Based DNS), and http://www.isc.org/products/BIND



 Python   SQL   Java   php   Perl 
 game development   web development   internet   *nix   graphics   hardware 
 telecommunications   C++ 
 Flash   Active Directory   Windows