Although DNS services are fundamentally simple, certain problems frequently appear. Quite often, unclear wording or poorly documented options in
various Windows dialog boxes can cause these
problems. Let's look at some common DNS
annoyances that plague administrators and
how you can deal with them.
Dynamic Updates Won't
Update
Windows allows clients to dynamically update A
and PTR records with DNS servers to help simplify DNS management across a domain. Thus,
in an AD-integrated zone, when you assign IP
addresses in your organization, client machines
can dynamically update AD with their new IP
address. Sometimes, however, you might notice
that client systems aren't properly updating
their DNS records with the new address. To
make updating work, you must configure the
DNS server to allow dynamic updates. To do so,
open the properties for the DNS zone and select Secure only for the Dynamic updates setting, as
Figure 1 shows.
Next, on the client, open the network adaptor's Advanced TCP/IP Settings dialog box,
select the DNS tab, as Figure 2, shows,
and make sure that Register this connection's
addresses in DNS option is selected.
Finally, the DHCP client service—not just
the DNS client service—handles DNS registration and must run on each system. Even if you
don't use DHCP to assign IP addresses, you
need the DHCP client service to run on each machine to dynamically update DNS records.
By default, a client will update DNS records
upon start-up, or when an IP address or name
changes, or when you force it to update by using
the ipconfig /registerdns command. Furthermore, the client will reregister its IP address
every 24 hours.
DNS Client Service
Causes Performance Hits
When the DNS client service starts, it loads all
entries in the hosts file to its cache. If you use a
very large hosts file to block access to unwanted
host names, you might find that this service significantly slows system performance. In such a
case, you might want to disable the service.
However, typically, disabling the DNS client
service will have no effect on DNS lookups. You
might wonder, then, why anyone would need
this service in the first place.
The answer is that the DNS client service
isn't necessary for name resolution; it just
makes name resolution smarter and more
efficient. The main purpose of the DNS client service is to provide local caching of DNS
entries. The service is, in effect, a DNS server
itself. Instead of publishing a database of DNS
records, it simply caches previously resolved
DNS records to speed up future lookups.
Besides caching, the service optimizes network connections by prioritizing resource
records based on network location, speed, and
availability.
The DNS client service also manages the
list of DNS servers configured on a system. As it does with resource records, the service selects
the best DNS server from the server list, based
on network location, speed, and availability.
Firewall Rules Need to Be
Optimized
When you configure a firewall to allow public
requests to a DNS server, you want to build rules
that won't let others exploit your configuration.
DNS queries typically come in on UDP port 53
from a source port greater than 1023. The DNS
server responds from source port 53 to the same
port used by the client. Most stateful firewalls
can handle DNS responses, so a single rule
governing requests should be enough.
If a query response is greater than 512 bytes,
the DNS server indicates to the client that the
response is truncated. The client can resubmit the query using Extended DNS, which allows for
larger UDP responses, or the client can resubmit
the response by using TCP. If you allow TCP queries, you'll need a rule that allows packets coming in on TCP port 53 from a source port greater
than 1023. If you know that your DNS server
won't return query responses larger than 512
bytes, you can leave this port closed. Some DNS
servers use UDP or TCP port 53 as both their
source and destination port for server-to-server
queries, so you might also need to configure your
firewall to allow this.
How Windows Queries
Multiple DNS Servers
By default, Windows first queries the first listed
DNS server on the primary network adaptor. If
this server doesn't respond within one second,
Windows sends the query to the first listed DNS
server on any other network adaptors on the
system. If it receives no response within two
seconds, Windows sends the query to all DNS
servers listed on all network adaptors on that
system. If none of these servers respond in two
seconds, Windows sends the query to all servers again and waits four seconds. If necessary, it
resends the query to all servers and waits eight
seconds.
Windows adjusts the list of DNS servers it
queries depending on network conditions. If
none of the DNS servers on an adaptor reply
to queries, Windows assumes a network failure
has occurred and doesn't query any servers
on that adaptor for 30 seconds. If one DNS
server on a network adaptor returns a negative
response to a query, Windows won't resubmit
that query to any other DNS servers on that adaptor. Furthermore, Windows might adjust
the order in which it queries DNS servers to
favor a server that responds more quickly than
others.