Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

General

If the person responsible for administering a DNS zone should change,
make sure you modify the SOA record for the zone to update the email
address of the zone administrator. The DNS Server service sends email
to this address automatically when query errors and other conditions
arise. Note that the email address substitutes the usual at symbol
(@) with a period (.); e.g., specify

info.mtit.com instead of

info@mtit.com .

DNS replaces the

Hosts file, which was the
original method for performing hostname-to-IP address name resolution
on a TCP/IP network. However, the

Hosts file can
still be used in smaller WS2003 networks instead of DNS if desired,
such as in a small intranet with no connection to the Internet.

You can start, stop, pause, and resume name servers by:

Right-click DNS server All Tasks {Start | Stop | Pause | Resume | Restart}

net stop dns | net start dns | net pause dns | net continue dns

Zones

Always have
at least two DNS
servers hosting each zone to provide fault tolerance for name
resolution.

DNS servers and zones don't map one-to-one. In fact:

• One DNS server can manage one or more zones for efficiency and
  delegating administration of subdomains.

• One zone can be stored on one or more DNS servers for fault tolerance
  and load balancing.

It is generally best to have at least one secondary name server per
zone. This way, if the primary name server for the zone goes offline,
clients can still resolve names.

Standard zone files are stored in

%SystemRoot%\System32\dns as a file with a

.dns extension. For example, the forward-lookup
zone for the

mtit.com domain would, by default,
be stored in the zone file

mtit.com.dns .

Resolvers

You can stop
or start the
DNS Client service on a WS2003/2000/XP computer with
net stop
"dns client" or
net start
"dns client".

Stopping the DNS client also flushes the resolver cache.

Resolvers can query both remote name servers and the local computer
if it is running the DNS Server service.

Troubleshooting

To troubleshoot DNS
server problems, you can use:

• nslookup, which can be used to issue DNS queries
  and examine zone files on local and remote servers.

• ipconfig, which can be used to view and flush the
  resolver cache and force dynamic updates by WS2003 clients.

• Event Viewer, which manages the DNS server log.

• The optional DNS log
  

  %SystemRoot%\System32\Dns\Dns.log , which keeps
  track of DNS server activity. This log is enabled and configured by:

Right click on DNS server Properties Logging
select logging options

• The DNS console to monitor the DNS server by:

Right-click on DNS server Properties Monitoring
select a test

Here is a basic troubleshooting procedure for checking a DNS server
if problems occur (stop at the step where the problem is resolved):

1. Check Event Viewer first.

2. Go to the client and try pinging the DNS server to test for basic
   network connectivity.

3. At the client, open a command prompt and type
   nslookup 127.0.0.1. If
   you get the name of the client in response to this, your server is
   OK. If it gives "Server failure" as
   a response, the server may simply be too busy (or the reverse-lookup
   zone in which the client's PTR record exists may be
   pausedcheck the General tab of the properties sheet for this
   zone on the server).

4. If the response is "Request to server timed
   out" or "No response from
   server," then go to the server, open a command
   prompt, and type net
   start dns. If DNS is
   already started, then check the Interfaces tab on the properties
   sheet of the server to make sure that the server is listening on the
   interface to which the client's subnet is connected.

If a client queries a DNS server and receives incorrect information
(wrong IP address for the queried FQDN), then you can troubleshoot
the problem like this:

1. Go to the client and flush the resolver cache by typing
   ipconfig /flushdns at a
   command prompt.

2. Type nslookup
   IPaddresstoresolve
   IPaddressofserver. If you get a correct
   response, the problem was a stale cache entry. If not, the zone
   information on your authoritative name servers is in error. If you
   were querying the primary name server (or if your DNS is integrated
   with Active Directory), check the resource records for your host and
   whether dynamic update is configured properly on the client. If you
   were querying a secondary name server, check if zone transfers are
   configured properly as well.

See Also

Active Directory ,

DHCP ,
nslookup