Recipe 18.11 Using BIND for DNS

18.11.1 Problem

You've decided that you do not want to use Microsoft DNS for Active Directory and instead prefer to use BIND.

18.11.2 Solution

The two main requirements for supporting Active Directory DNS are SRV records and Dynamic DNS support. The first version of BIND to support SRV records was 8.2.2 patch 7. Hopefully you are running a much more recent version since that was released in 2000. You technically don't have to use DDNS with Active Directory DNS records, but if you don't, you end up doing a lot of work to manually maintain the Active Directory-related resource records.

Here is an example BIND 8 configuration to support the ad.rallencorp.com domain:

Options {
directory "/etc/namedb";
};
Zone "ad.rallencorp.com" IN {
type master;
file "db.ad.rallencorp.com";
allow-update { dc1.; dc2.; dc3.; };
check-names ignore;
};

The directory directive specifies where the zone files are stored. The type should be master, and the file directive is the name of the file to store the contents of the zone in. The allow-update directive indicates which servers (either by name or IP address) can dynamically update the zone. Finally, the check-names ignore directive tells BIND not to be restrictive about the names used in resource records. Without this setting, BIND would fail to respond to queries for records containing underscores used by Active Directory.

The BIND 9 configuration for the same zone would look exactly the same, except the check-names ignore line is not necessary. By default, BIND 9 allows underscores in resource records.

After your BIND servers are properly configured, be sure the resolver on your domain controllers points to at least one of the BIND name servers. This can be done by going into the Network Connections for each domain controller and right-clicking the active connection. Click on Properties, highlight Internet Protocol (TCP/IP), and select Properties. You can configure the resolvers under the General tab. This setting can also be configured through DHCP or Group Policy.

18.11.3 Discussion

See Recipe 13.13 for forcing a domain controller to reregister its records and Recipe 13.12 for verifying a domain controller can register its records.

BIND documentation and source can be downloaded from the following ISC site: http://www.isc.org/products/BIND/.

18.11.4 See Also

MS KB 255913 (Integrating Windows 2000 DNS into an Existing BIND or Windows NT 4.0-Based DNS Namespace), and MS KB 323419 (HOW TO: Migrate an Existing DNS Infrastructure from a BIND-Based Server to a Windows Server 2003-Based DNS)