DNS zones

Posted on 2011-04-24
Last Modified: 2012-05-11
Hi all,

DNS is one thing i'm just not ever going to get a grasp of...

Two situations


If you have the zone to which there is, for to resolve records in something has to be done i..e stub zone, delegation..etc correct?


This is my my sticking point; If you have another setup with, which also has,, and

Server config  = Server1 hosting secondary zones for, and

Server2 hosts secondary zone for

server3 hosts secondary zone for

there are no delegate records in, or and the other servers in only use server2 as the DNS server

Where I get lost is, when configuring forwarding for you only forward to, and Why wouldn't need forwarding to? How would it resolve names in there?

Been told "To configure the forest with forwarding makes no sense. It's not practical. To who would forwarding occur".....I dont get it. My argument was it's forwarding to  so it can resolve names in there

Please can someone explain
Question by:LFC1980
    LVL 38

    Expert Comment

    There is one thing I found out about IT that is consistent with any other job. To learn things all you have to do is put things into a persepective that you can understand. DNS is really one of the easiest services to grasp, if you can follow the path a DNS query takes. The path is drawn out and all functions of DNS are described on this thread I wrote.

    Since it seems like you have a firm grasp on all that information, let's move into the delgation records.

    Upon setting up a domain, the first domain server within the Forest will set up a delegation record. Now, that record points to an MSDCS zone. It's just a pointer. The MSDCS zone that is set up, is used to easily transfer that zone to other DCs on the forest. So, it is hanging out there to be easily replicated.

    The only problem with that delegation record that points to the MSDCS zone is, that delegation record doesn't dynamically update itself. So, all of a sudden, you loose track of the SeRVice (SRV) recrods in that MSDCS zone. What happens when the delegation record expires is, you loose track or pointers to domain SeRVices.

    This is what it looks like, when this happens:

    Yep, I ran into this issue, too.

    Delegation records only point to the MSDCS zone where your SRV records reside.

    Author Comment

    Thanks for those articles. First one as you say reinforces, what little I do know. But I'm still non the wiser to my question :(

    Why is it impracticable to forward requests to from Without doing so, how would the resolve anything in
    LVL 38

    Expert Comment

    First off, let's separate your domain, from any outside domain. What you want is your local machines to look towards your DNS server first. Then, the server forwarders will look outside the domain for any other resolution.

    For instructive purposes, let's call your domain ( Let's call an outside server (

    Upon logging on, All clients on will go to a preferred DNS server. That server is passed down by DHCP or manually configured by you for fixed IP clients. So, let's say you have two DNS servers on their IPs will be and As clients perform a DNS query, it will check within their DNS cache first, then any configured host record. If the clients can not resolve the query themselves, they will look towards those two servers to resolve for So, you are looking at the top level domain servers for your domain. If your server can not provide DNS resolution. It will start looking outside your network, to forwarded servers. This is the only place that comes into play. could be public servers, like google. Google's IPs are and, (or something like this). These are public DNS servers that resolve DNS and can be used as forwarding servers.

    A delegation record is a pointer to the forest server's SRV record. THESE records are very important to the domain. They point to DOMAIN services. So, if you point your clients to to find these SRV records, they can not be found. In other words, if your client computers are pointed to to find services for, you will not be able to find domain services.

    On a home computer, domain services are NOT NEEDED, unless you VPN into your domain for domain services. So, you can point your home clients to an outside DNS server for DNS resolution.

    The differences between going to an outside server and an inside server is DOMAIN SERVICES. This is why you have to point your clients to an inside server for Domain services and DNS.  

    Author Comment

    Everything you say makes sense. But I can't put that together to make sense of what i'm stuck on. Let me break it down into questions to see where I'm not getting it

    Look to internal DNS servers then external (should that be configured) - This i get

    Lets say I have then there is another zone So, to let users resolve in XXX there needs to be a delgation or stub zone in for XXX

    Q1) Is my statement above correct?

    2nd scenario

    This has nothing to do with above domain. so consider I have, which also has,, and

    In this network

    DNS01 hosts secondary zones for, and
    DNS02 hosts secondary zone for
    DNS03 hosts secondary zone for

    so for to resolve names in others you need to configure forwarding to for the following domains, and

    Q2) how would resolve names in if there is no seting that references it to forward to

    Author Comment

    I was told " is the forest, to configure the forest with forwarding makes no sense. It's not practical. To who would forwarding occur".....I just do not get it.

    My argument was it's forwarding to  so it can resolve names in there. Why is this incorrect. how would resolve in without that forwarding

    LVL 38

    Expert Comment

    I think you are interchanging terms. A forwarding server is a server that can not provide DNS resolution on the local domain. So, the server points in the direction of a forwarding server or a root hints server. SOOOO. If the local domain controller can't resolve, the next best step is your forest server. From there, your ISP's server for outside the forest resolution.

    Client>>>Domain Server>>>Forest Server>>>ISP's server

    A forwarding server is just a referal to another server to get DNS resolution. In other words, it's passing the buck to resolve a DNS query. EXAMPLE server can't resolve, so let's go to the forest server to see if it can resolve for somewhere within the forest.

    A forwarding server is NOT forwarding all of its records to lower level domain controllers within the forest. That's up to your ZONE TRANSFERS. EXAMPLE: I have a list of DNS zones, that I would like to see on many of my servers. So, let's zone transfer those zones to all DNS servers within the Forest.

    Don't mix up the terms 'Zone Transfers' and 'Forwarding'.

    Author Comment


    so what process would use to resolve in
    LVL 38

    Accepted Solution

    This is how it works:

    Client sends out a DNS query. It looks at it's own records (cache and the host file). If it can't find anything there, it goes to YOUR server. The server looks through the host files. If the server can't find it, it will send a request to the FORWARDING server.

    This process passes the buck until DNS resolution is provided. How your client gets is your server send out a request to a server that is outside your domain. So, if you are in a forest, your forwarding server might be the forest server. EXAMPLE>>>>

    you see is the top-level domain controller for mydomain and your domain.

    Author Closing Comment

    Think it makes sense. Will have to come back to this as i've been side tracked

    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    Join & Write a Comment

    Suggested Solutions

    Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
    I've written instructions for one router type, but this principle may be useful for others of the same brand and even other brands of router. Problem: I had an issue especially with mobile devices that refused to use DNS information supplied via…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now