- Client operating system exams
- Server operating exams (core networking and design exams)
Server operating exams (core networking and design exams)
Okay, time to get a bit more advanced. The core networking exam involves the steps taken to set up a Microsoft DNS server, so if you haven’t setup a home lab by this point then it’s a good time to start one. Hands-on practice with DNS is a must when it comes to understanding how it works.
This may seem like nothing more than a laundry list of topics for further study; so to avoid repeating what is already explained in your Microsoft reading materials, I’ll just highlight some key areas of DNS within the core and design networking exams.
DNS recursion
The role of the DNS server is to resolve hostnames to IP addresses; we got that bit down earlier. However, if the DNS server doesn’t hold the name resolution data in its cache or its zone records to answer a host computer’s query, it has to use a process called recursion. You should understand the recursion process, how to make your server recursive or non-recursive, and how it affects a server’s workload. The way a DNS was designed to work is if a name cannot be resolved, it references its root hints to send iterative queries to the root servers on the internet, and then work back from the root to resolve the eventual name requested. This is then cached and referenced for the same request next time. It is also common to use conventional or conditional forwarding to cut out recursion on a local DNS server, by forwarding to a DNS server in your DMZ or your ISP, for example. Make sure you know why and when you would use forwarding over the normal recursion process. I should also mention caching servers here briefly too, as they are often perimeter-based servers, which help reduce recursive queries.
Getting in the zone
The setting up of your DNS zones is a common simulation question in Microsoft exams, so as mentioned above, get the practice in. There are three zone types: primary, secondary, and stub. The primary zone represents your domain, and this is where your DNS requests are resolved, whether it is through the cache, the zone records, through conventional/conditional forwarding, or root hints. The secondary zone is commonly used within child domains and is a read-only copy of the primary zone. The zone information is updated through zone transfers, which then relays the DNS zone information between zones, whether it is between primary zones, between primary and secondary zones in a child domain, or the updating of stub zone information from their master server’s zone.
Make sure you know how resolution works back to your primary zone as well, through the use of delegations or root hints. Also take the time to know the function of the Start of Authority (SOA) record and its importance in relation to zone updates. I will talk more about stub zones a bit later.
A common error within DNS server setup is to not setup a reverse lookup zone. This is an obvious requirement if you want to be able to resolve your IP addresses to your hostnames efficiently.
DNS resource records
The DNS records are what populates your DNS database, and although there are a lot of different records listed, the main ones to know for the exam are the Start of Authority (SOA) record (as mentioned earlier), the Name server (NS) record which references the DNS server responsible for the domain, the A or host record, the PTR record for reverse lookups, MX records for your e-mail servers, and the CNAME for your aliases. Although these are simple text files, you need to understand their properties. They all have a time to live (TTL), which is important for when records are scavenged (the process of removing old records from the database). And they have a weight, which sets their priority if you are resolving to multiple servers. Although I am a bit guilty of it here, don’t skip over resource records, as they are a key troubleshooting area. If you are having name resolution errors it may be done to an incorrectly registered A record. When it comes to zone transfers and the transferring, refreshing or reloading of zone data, then the SOA record keeps a numerical count on domain changes, which is handy for ensuring proper replication is occurring.
DNS replication and zone transfer
When it comes to setting up a Microsoft DNS server, it is accepted practice that in order for this to be setup securely it is integrated with the active directory. If you are setting up a standalone DNS server, then make sure you know how to secure the DNS database and the ports it operates; this is an area covered in the elective security exams. The replication scope of your DNS server is another security factor to consider. You should understand the importance for choosing the right scope for your DNS server, and you how you can also use the dnscmd to customize your replication scope as well as running a number of zone transfer related tasks.
One of the main areas of DNS Microsoft likes to question candidates on is when you would use stub zones, conditional forwarding, and delegations. Make sure you can distinguish between them and when the appropriate time is to use them; Microsoft knows that they can get you in a pickle trying to establish the right one for the job. It is maybe easier to look at stub zones as another host record, except it’s for a completely different domain, such as another company, for example. When your zones are queried for resources in the other companies’ domain, the stub zone will redirect them accordingly, as they contain the authoritative records for the domain and are dynamically updated for any changes. You may start scratching your head when you get to conditional forwarding, as it appears to do the same thing. Which is true, but as far as Microsoft best practice goes, stub zones are more efficient as they work how DNS was intended to. If you start to load up your conditional forwarders list, the DNS workload will increase too, and so it shouldn’t be over used. Conditional forwarding was new for Windows Server 2003, so if you are working towards your MCSA or MCSE you are bound to be questioned on it, including how it is different from the original conventional forwarding.
You would use delegations if you had a secondary zone and you wanted to delegate DNS responsibility for the child domain to the secondary server. DNS queries for the parent domain from the child domain would either be forwarded or resolved through root hints, which would be re-populated with the parent’s DNS servers. Understand that delegations are not dynamic and must be manually administered. It is common that questions related to secondary zones and delegations will have possible answers related to stub zones. The use of stub zones seems to make sense over delegations as they are dynamic and seem to do the same job, right? Well it comes back to Microsoft best practice again, as delegations contain information on the servers in the child domain. The zone transfer information contains all the information about the parent and child domain and the delegation information. If stub zones were used, then the primary server would never know about the servers in the child domain, which is not ideal. They could both be implemented for failover, but this would be overkill, really. Make sure you have this straight in your mind before going into the exam, as it’s likely question material.
What’s new in DNS in Windows Server 2008?
There have been some new additions to the DNS server role in the Windows Server 2008, unsurprisingly most of them are related to security. In recent years certain security holes have been picked in the Microsoft DNS server which left it wide open to cache poisoning and a like. As a result, Microsoft has added in a number of security features within Windows Server 2008. DNS socket pool makes accessing the DNS server much harder for attackers, and combined with another new feature, cache locking (used to prevent cache record changes based on the time to live lifespan), helps protect the integrity of the DNS cache. In terms of protecting DNS zones and its resource records, DNS security extensions (DNSSEC) have been introduced. This incorporates digital signing into DNS query communications to ensure the query response is from an authorized source. At the moment, only Windows 7 clients can get responses from DNSSEC-enabled servers, which is worth noting in case you get an exam question on this topic and it mentions functionality with older operating systems. In short, you can bet your exam fee that they will be asking questions related to these new features in their certification exams.
Another addition is DNS devolution which is covered in the latest client operating system exams. This involves configuring the TCP/IP properties with the required domain suffixes in order for resolution to occur, dependent on the devolution level you set.
DNS troubleshooting
As mentioned at the start, if you are aware of the DNS process and the stages as they occur, then finding the problems is a lot easier. You are guaranteed to get questions in regards to troubleshooting DNS, so make sure you are aware of all the tools available to you. Within the DNS console itself you have a dedicated event log for DNS. You also have DNS auditing, which is not enabled by default as it can be quite resource hungry, but it is very useful in troubleshooting granular DNS events as they happen and then logs them for analysis. Make sure you check out the monitoring tab for name resolution internally and externally, as this can be useful in defining the scope of the issue quickly.
There are a number of command line tools which also come in handy at this stage:
- Ipconfig /flushdns helps clear out negative caching, /registerdns will register the computer in DNS.
- A particularly useful tool is nslookup, which can be used to test and troubleshoot your DNS server records and domain name resolution.
- I mentioned the dnscmd earlier; this is a useful tool for creating specific replication partnerships and also managing zone transfers through the command line. The net stop/start DNS usually goes well with this for restarting the DNS server service.
- If you are studying for the MCSA or MCSE exams, then the netdiag and the dcdiag /test:dns commands produce useful outputs in regards to DNS functionality in your domain.
It is likely that if you are asked questions on troubleshooting DNS outside of a simulation, then they will be on which tool is best to resolve a specific error. Ensure you know what each one does and when it should be put into action.
If you are looking to take a Microsoft certification exam in their networking series, then make sure you are fully versed in domain naming systems. It is an important part of Microsoft networking, and as well as being a major topic in both the core and design networking exams, it also appears somewhere in all of the related elective exam topics, such as Microsoft Exchange.
If you know the inner workings of DNS and you keep the mind set of Microsoft best practice at the forefront, then this will make passing your Microsoft exams a much easier task.