[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1490
  • Last Modified:

Script to Consolidate DNS Reverse Lookup zones

We have a very large network (18K clients, 1200 servers), and I inherited DNS -- running Win2k3 AD with MS-Integrated DNS. One problem is that we have hundreds of DNS Reverse Lookup zones (in-addr.arpa), many of which have overalpping ranges. i.e.
10.0.0.0
10.1.2.0

These zones contain both static and dynamic PTR records. This is working, for the most (records are normally added to the most specific zone), but in an effort to cleanup and ease administration (since many zones are miscofigured with different aging, scavenging, allow dynamic updated, etc), I would like to consolidate the more specific ranges to the higher level CIDR range.

Is there a problem doing this type of consolidation? What do I need to be careful of with the static records? Most importantly, does anyone have a script, perhaps using DNSCMD, that would make this job easier?  This needs to be seamless to the users, of course.

I read one of Chris-Dent's threads that sounded like he may have a script for this. Chris?

Thanks!
0
KirkAHS
Asked:
KirkAHS
  • 4
  • 3
  • 2
1 Solution
 
arnoldCommented:
PTR records in most cases get updated by the network interface or the DHCP server.
Private IP PTR are for reference only and I do not believe there is any application that would deny a user access either because of the absence of a PTR record or because it is mismatched.
Create a new CIDR pool and see how it goes.

the only reason to setup the private IP pool on an internal DNS is to avoid the forwarding of those requests wasting resources.
0
 
Chris DentPowerShell DeveloperCommented:

It would probably work best to export the static records, then let any dynamic records deal with themselves in a new zone. Happy with Windows PowerShell?

Single domain forest? And do the existing DNS zones already replicate across the entire enterprise?

Chris
0
 
KirkAHSAuthor Commented:
Chris,
Yes, it's a single domain forest.
Yes, we replicate all zones across the forest (all DC's)
Yes, no problem using Powershell (I run Win7 on my Admin PC, and Win2k3 on the DC's.)

Thanks!!
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
KirkAHSAuthor Commented:
I know everyone's been busy with the holidays... I could still use a script for this, so I've bumped up points to max 500. Chris, any luck?

Thanks!!
0
 
Chris DentPowerShell DeveloperCommented:

Sorry, got completely side-tracked. Lets get the static records out of the zones first. This PowerShell command will do for that part:

Get-WMIObject -Computer $ServerName `
  -Namespace "root\MicrosoftDNS" -Class "MicrosoftDNS_PTRType" `
  -Filter "TimeStamp=0" | Select-Object TextRepresentation

See if that returns every static record you want?

If it does, there are two choices. Either we can create a brand new zone file using those records as the base (and a reasonable SOA and NS record set), or we can import into an existing zone. The first is perhaps easiest because it'll be a copy and paste job, changing the zone type to AD Integrated after the event.

If we go for the first option, not much work is required. Run this modified command:

Get-WMIObject -Computer $ServerName `
  -Namespace "root\MicrosoftDNS" -Class "MicrosoftDNS_PTRType" `
  -Filter "TimeStamp=0" | %{ $_.TextRepresentation >> "NewZone.dns" }

The file will be created as it adds the first record, we can add the SOA and NS records once it's done. Then we can create the zone either using DNSCMD, or via the GUI, using the existing file. Dead easy :)

Chris
0
 
Chris DentPowerShell DeveloperCommented:

Missed a bit. $ServerName must be set. e.g.

$ServerName = "YourDNSServer"

Otherwise the variable should be replaced with the server name.

Chris
0
 
Chris DentPowerShell DeveloperCommented:

Actually, we will need one slight modification. The "in-addr.arpa" in the text representation needs a terminating period or it'll get horribly confused.

$ServerName = "YourDnsSever"
Get-WMIObject -Computer $ServerName `
  -Namespace "root\MicrosoftDNS" -Class "MicrosoftDNS_PTRType" `
  -Filter "TimeStamp=0" | %{ $_.TextRepresentation -Replace "arpa", "arpa." >> "NewZone.dns" }

Once that's done, correct the server name (and domain name for the hostmaster e-mail) in the snippet below and drop it at the top of the created file.

That completes the zone file, all that remains is to nuke the existing zones and create a new one, using the file we've created as the base. Ideally test that part if you can, a stand-alone DNS server will work for it (not a DC).

Chris
@  IN SOA  yourdnsserver.domain.com. hostmaster.domain.com. (
        1          ; Serial number
        172800     ; Refresh (2 days)
        900        ; Retry (15 mins)
        1209600    ; Expire (2 weeks)
        3600)      ; Minimum TTL (1 hour)

@  IN NS  yourdnsserver.domain.com.

Open in new window

0
 
KirkAHSAuthor Commented:
I will give this a shot (test in the lab first.) Looks simple enough. Thanks for the great Powershell script, Chris!
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 4
  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now