SBS2003 migration to new win2k3 STD DC DNS issues

Hi bloodymalth5,

Thank you for responding. Simple enough but I'm not sure how that happened, and that's bad since I'm the one who configured the server... It definitely shouldn't be pointing to ns51.1and1.com. Where do I change that? Can I change that? Here's an IPCONFIG:



Windows IP Configuration



   Host Name . . . . . . . . . . . . : REV1

   Primary Dns Suffix  . . . . . . . : dambrosiolawoffices.com

   Node Type . . . . . . . . . . . . : Unknown

   IP Routing Enabled. . . . . . . . : No

   WINS Proxy Enabled. . . . . . . . : Yes

   DNS Suffix Search List. . . . . . : dambrosiolawoffices.com



Ethernet adapter VMware Network Adapter VMnet8:



   Connection-specific DNS Suffix  . :

   Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for VMnet8

   Physical Address. . . . . . . . . : 00-50-56-C0-00-08

   DHCP Enabled. . . . . . . . . . . : No

   IP Address. . . . . . . . . . . . : 192.168.174.1

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Default Gateway . . . . . . . . . :



Ethernet adapter Local Area Connection:



   Connection-specific DNS Suffix  . :

   Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet

   Physical Address. . . . . . . . . : 00-1A-A0-11-3D-24

   DHCP Enabled. . . . . . . . . . . : No

   IP Address. . . . . . . . . . . . : 10.0.0.1

   Subnet Mask . . . . . . . . . . . : 255.0.0.0

   Default Gateway . . . . . . . . . : 10.0.0.254

   DNS Servers . . . . . . . . . . . : 10.0.0.1

   Primary WINS Server . . . . . . . : 10.0.0.1



Ethernet adapter VMware Network Adapter VMnet1:



   Connection-specific DNS Suffix  . :

   Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for VMnet1

   Physical Address. . . . . . . . . : 00-50-56-C0-00-01

   DHCP Enabled. . . . . . . . . . . : No

   IP Address. . . . . . . . . . . . : 192.168.72.1

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Default Gateway . . . . . . . . . :

I didn't mention that this is actually a publicly available domain. I've done this before though, without this problem...

How large is this network now?  I ask because you are now using a 255.0.0.0 subnet which I would think is WAY bigger than you would ever need.  Using a Class "C" subnet (255.255.255.0) will protect you a bit more and still provide you with 254 IP addresses.

Your problems though aren't in the NIC configuration, but rather how you've set up DNS... which is totally incorrect and is now fairly poisoned.  So you would be best to delete all the zones, uninstall DNS, and then reinstall properly.

What you have to be careful of when using a publically resolvable TLD for your Active Directory Domain Name is that AD wants your DNS Zone to be authoritative for the domain... however, it's NOT and shouldn't be authoritative for the public Domain Name... that is what you have 1and1's DNS Zone for.  

To make sure that you don't accidently cause the two to link up, you need to be extra sure that TCP & UDP Port 53 and 135 are not open on your firewall.  Remember that your AD Domain and the public Internet domain have absolutely NOTHING at all to do with eachother.  (which is why it's often recommended to use a non-routable TLD such as .local for your AD domain name).  Then, you should ONLY use the DNS IP addresses of your Internet Service Provider (which may not be 1and1) for the FORWARDERS in the DNS Server Properties.  

The authoritative Name Server for your AD's DNS Server should be REV1.dambrosiolawoffices.com.

Details on how to configure are at http://support.microsoft.com/kb/323380

Jeff
TechSoEasy

Hi Jeff,

Thanks for responding. They're not hosting a publicly available DNS server, so incoming traffic is not allowed on those ports. Let me just summarize the plan:

- Delete zones
- Uninstall dns
- reboot
- reinstall
- reconfigure

Correct?

Essentially, yes.

But just FYI, blocking the ports will only block traffic inbound... and that was only half of my concern.  The way it's currently configured, it's trying to replicate with the public DNS server which is totally wrong because that can also cause the public server to get all of your internal IP addresses.

I'm assuming that 1and1 is NOT the Internet Access Provider for this office... but just hosting their Domain Name and web site.  So don't even use ANYTHING from 1and1 in the DNS setup.  Only use their Internet provider's (ie, Verizon) DNS Server IP's.

Jeff
TechSoEasy

Just an FYI... in looking at your Whois Record, (http://snipr.com/1qgp5) I see that you entered NA for all the contact info.  You can't legally do that... and sooner or later, 1and1 will send you an email giving you 5 days to fix it along with an administrative bill for them having to ask you to do it.

So, you either need to pay for using a Proxy Registrar (Anonymous registration) or just fill in the info.  In my opinion, since you already have the firm's address on the web site, it's no big deal to have it listed in the domain registration.

Jeff
TechSoEasy

OK... I'll take care if that... I blocked outgoing... I run dcdiag /v and 1and1 is still showing up as authoritative... What do I have to do to get rid of it?