DNS Server Deployment and Redundancy

Overview

This project involved deploying and configuring DNS services on Windows Server for an Active Directory environment. I configured the primary DNS server on the forest root domain controller, created forward and reverse lookup zones, configured DNS forwarders and conditional forwarders, and added the required DNS records for internal services.

To improve availability and DNS query performance for another department with a large number of clients, I also configured a secondary DNS server and enabled zone transfers from the primary DNS server. The configuration was then tested using ping and nslookup to verify internal and external DNS resolution and the synchronization of DNS records between the two servers.

Objectives

• Configure and manage DNS Server on Windows Server.

• Configure forward and reverse lookup zones for the Active Directory environment.

• Add and manage A, PTR, and CNAME records for internal services.

• Configure DNS forwarders for resolving external domains.

• Configure conditional forwarders for DNS resolution across different domains.

• Configure a secondary DNS server for redundancy and improved query performance.

• Enable and verify DNS zone transfers between the primary and secondary DNS servers.

• Test internal and external DNS resolution from the secondary DNS server.

Technologies Used

• Windows Server

• DNS Server

• DNS Manager

• Active Directory Domain Services

• Forward and Reverse Lookup Zones

• DNS Forwarders

• Conditional Forwarders

• DNS Zone Transfer

• A, PTR, CNAME, and TXT Records

• ping

• nslookup

Configurations

Primary DNS Server

The primary DNS server was configured on the forest root domain controller. The DNS Server role was first installed through Server Manager.

DNS Manager Configurations

I opened DNS Manager and accessed the server properties. In the Interfaces tab, I selected the network interfaces on which the server should respond to DNS queries. Since the server had only one connected interface, I left the default configuration unchanged.

In the Forwarders tab, I configured several reliable DNS forwarders for resolving domains that were not hosted in the server's local DNS zones.

The first forwarder was the MikroTik edge router, which provided DNS caching. I also configured two DNS servers provided by Data Communication of Iran (DCI). These local DNS servers were preferred over commonly used public DNS services because they generally provided faster responses and were more reliable in the network environment.

I also enabled DNS server monitoring and configured the required testing interval.

Zones

I created a Reverse Lookup Zone for the forest root domain's network. This allowed PTR records to be created for hosts registered in the corresponding forward lookup zone.

During the Reverse Lookup Zone configuration, I entered the network address for which reverse DNS resolution was required. The resulting zone was displayed in reverse order according to the standard in-addr.arpa structure.

The reverse lookup zone was created and shown in a reverse order as the ARPA standard. This approved the successful creation of reverse lookup zone for the domain.

I then added DNS records to the Forward Lookup Zone for the forest root domain.

For example, I created an A record for the primary DNS server using DNS as the hostname and 192.168.88.18 as its IP address. This created the hostname dns.moradilab.local. I also enabled the option to create an associated PTR record so that reverse DNS resolution could return the server's hostname.

The added record shown in the related domain container in Forward Lookup Zone.

I then created a separate Forward Lookup Zone for servers that provided services within the environment. This zone was configured with domain-wide replication rather than forest-wide replication because the server IP addressing information was intended to remain within the relevant domain.

Then from Forward lookup zone, I created a new zone and this time I chose the replication be applied on the current domain wide, not forest. This is because I didn’t want other domains know the critical of IP addresses I assigned on the servers.

The new zone was named servers.local.

I manually added the required DNS records for the servers providing services such as FTP, mail, and web services.

For the web server, I created an A record for web.servers.local. I also created a CNAME record that mapped the company's public domain name, xco.com, to web.servers.local.

The final records were as bellow.

Conditional Forwarders

I configured Conditional Forwarders to send DNS queries for specific domains directly to their corresponding DNS servers.

For example, the MikroTik router provided DNS caching for its own domain. I created a conditional forwarder for that domain and specified the router's IP address as the target DNS server.

I repeated this configuration for other domains within the forest that were separate domains rather than child domains.

This allowed DNS queries for each domain to be forwarded directly to the appropriate DNS server.

On Secondary DC

Because another department had a large number of clients, I configured a secondary DNS server to provide redundancy and improve DNS query availability.

Before configuring the secondary DNS service, I verified that the server's date and time were synchronized with the NTP server. I also verified that the Windows Server had the correct hostname instead of the default system name.

I then configured a primary DNS server’s IP address on secondary DNS server as it can resolve domain related hostnames successfully.

After rebooting the server to make sure the configurations are applied successfully, I checked whether the connectivity is available between two servers using ping. Since the secondary server could ping the primary server, I guessed the firewall is dropping the ICMP messages on the second server. Therefore, I enabled “File and Printer Sharing (Echo Request - ICMPv4-In)” in “Inbound Rules” of firewall. Then I made the ping test and successfully received the ping reply from the second server.

Then, to make sure that connection is still available between these two servers I pinged the primary domain controller by its domain name, and successfully received response from it.

Zone Transfer

Then on the primary DNS server, I needed to allow Zone Transfer for the zone I wanted to have a secondary DNS server on. Otherwise the transfer would not be done.

To do this, in DNS Manger, from the left menu, I right-clicked on the desired forward lookup zone I wanted to allow transfer, and went to Properties > Zone Transfer.

Now on the seconds server which is needed to be the secondary zone, I right-clicked on the Forward Lookup Zones > New Zone. In the next step, I chose “Secondary Zone” from the options, as I wanted to have a copy DNS records of the first server on this server.

Then I entered the domain name of the primary DNS server, and entered its IP address. Server validated the domain name with the IP address.

Finally, after finishing the configuration wizard, I closed and re-opened the DNS Manager console in order to new updates and changes apply on the server be shown in console. using refresh usually doesn’t help at this stage.

As the final step, I needed to change the DNS server address of seconds Windows Server that on the machine itself. This is different from DNS configurations, but is related to the host itself. Therefore, I assigned the first DNS server address as a loopback, and the second DNS address as the primary DNS server.

Testing and Verification

To make sure that DNS server is working properly on the second server, I made the tests using CMD:

First I tried to ping the primary DNS server using its domain name:

ping moradilab.local

Pinging moradilab.local [192.168.88.18] with 32 bytes of data:

Reply from 192.168.88.18: bytes=32 time<1ms TTL=128

Reply from 192.168.88.18: bytes=32 time<1ms TTL=128

Reply from 192.168.88.18: bytes=32 time=1ms TTL=128

Reply from 192.168.88.18: bytes=32 time=1ms TTL=128

Ping statistics for 192.168.88.18:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 1ms, Average = 0ms

Then I tried to ping a public domain, like Google:

ping google.com

Pinging google.com [172.217.20.46] with 32 bytes of data:

Reply from 172.217.20.46: bytes=32 time=113ms TTL=113

Reply from 172.217.20.46: bytes=32 time=114ms TTL=113

Reply from 172.217.20.46: bytes=32 time=114ms TTL=113

Reply from 172.217.20.46: bytes=32 time=115ms TTL=113

Ping statistics for 172.217.20.46:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 113ms, Maximum = 115ms, Average = 114ms

I used nslookup to resolve more domain’s IP address, and checked which DNS server is responding to my requests. Results showed that the current secondary DNS server successfully responding to my requests.

nslookup

Default Server:  localhost

Address:  127.0.0.1

> google.com

Server:  localhost

Address:  127.0.0.1

Non-authoritative answer:

Name: google.com

Addresses:  2a00:1450:4007:80f::200e

       172.217.20.46

> wikipedia.org

Server:  localhost

Address:  127.0.0.1

Non-authoritative answer:

Name: wikipedia.org

Addresses:  2a02:ec80:600:ed1a::1

       185.15.58.224

> nic.ir

Server:  localhost

Address:  127.0.0.1

Non-authoritative answer:

Name: nic.ir

Addresses:  2001:14e8:c:0:194:225:70:16

       194.225.70.16

The “Non-authoritative answer” line shows that expectedly the queries are being resolved by general forwarders assigned on the server, and are not from lookup forwarder zones in Windows Server’s DNS server.

To make sure the secondary DNS server is receiving DNS record updates from the primary server I added a new A record on the primary server Forward Lookup Zone, then used Transfer from Master option, and used Refresh on the zone to see the new records on the secondary server:

I used nslookup again to make sure queries are replied by the current server successfully:

nslookup

Default Server:  localhost

Address:  127.0.0.1

> router.moradilab.local

Server:  localhost

Address:  127.0.0.1

Name: router.moradilab.local

Address:  192.168.88.1

> set type=txt

> moradilab.local

Server:  localhost

Address:  127.0.0.1

moradilab.local text =

     "This is a TXT record for test."

Results

The DNS environment was successfully configured and tested on both the primary and secondary Windows Server systems. Internal hostnames were resolved through the configured forward and reverse lookup zones, while external domains were resolved through the configured DNS forwarders.

Conditional forwarders also allowed DNS queries for other domains to be sent directly to their corresponding DNS servers. The secondary DNS server successfully received zone data from the primary server, providing DNS redundancy for the department.

The final tests confirmed that the secondary DNS server could resolve internal records, external domains, and transferred DNS records successfully.