7.4 Zone Datafile Controls

The datafiles for all name servers, whether Microsoft or BIND, can include two control entries: $ORIGIN and $INCLUDE. $ORIGIN changes the origin, and $INCLUDE inserts a new file into the current file. These control entries are not resource records; they facilitate the maintenance of DNS data. They were designed back in the "good old days" as a shortcut for people who had to edit zone datafiles by hand. If you make changes to your zones with the DNS console only, you won't encounter these controls: the Microsoft DNS Server doesn't use them in the zone datafiles it generates. However, some day you might need to work with zone datafiles created by hand, so it's important that you understand these controls.

7.4.1 Changing the Origin in a Datafile

The default origin for a DNS datafile is just the domain name of the zone. The origin is a domain name that is appended automatically to all names not ending in a dot. This origin can be changed within the zone datafile using $ORIGIN, which must be followed by a domain name. (Don't forget the trailing dot if you give the full domain name!) From that point in the file on, the new origin will be appended to all names not ending in a dot.

If we didn't have the DNS console to make changes and had to edit files by hand, we'd run into times when $ORIGIN would save us some work. For example, if your name server were responsible for a number of subdomains, you could use the $ORIGIN entry to reset the origin and simplify the files. For example, from the movie.edu zone datafile:

$ORIGIN classics.movie.edu. 
maltese       IN  A  192.253.253.100 
casablanca    IN  A  192.253.253.101

$ORIGIN comedy.movie.edu. 
mash          IN  A  192.253.253.200 
twins         IN  A  192.253.253.201

We'll discuss creating subdomains in Chapter 10.

7.4.2 Including Other Datafiles

To continue our example of editing zone datafiles by hand: once you've subdivided your domain like this, you might find it more convenient to keep the subdomain records in separate files. The $INCLUDE statement would let you do this:

$ORIGIN classics.movie.edu. 
$INCLUDE classics.dns

$ORIGIN comedy.movie.edu. 
$INCLUDE comedy.dns

To simplify the file even further, the new origin can be specified on the $INCLUDE line:

$INCLUDE classics.dns classics.movie.edu. 
$INCLUDE comedy.dns   comedy.movie.edu.

When you specify the origin on the $INCLUDE line, it applies only to the particular file that you're including. For example, the comedy.movie.edu origin applies only to the names in comedy.dns. After comedy.dns has been included, the origin returns to what it was before $INCLUDE, even if comedy.dns contained an $ORIGIN entry.

Remember that, strictly speaking, you don't need to know anything about these directives to create subdomains with the DNS console, and the Microsoft DNS Server doesn't generate zone datafiles using these shortcuts. But you do need to know about them to complete your knowledge of zone datafiles.

7.4.3 Keeping Everything Running Smoothly

A significant part of maintenance is being aware when something has gone wrong—before it becomes a real problem. If you catch a problem early, chances are it'll be that much easier to fix. As the adage says, an ounce of prevention is worth a pound of cure.

This isn't quite troubleshooting—we'll devote an entire chapter to troubleshooting (Chapter 15)—but you can think of it as "pre-troubleshooting." Troubleshooting (the pound of cure) is what you have to do if you ignore maintenance, after your problem has developed complications, when you need to identify the problem by its symptoms.

The next two sections deal with preventive maintenance: looking periodically at the Event Log and the name server statistics to see whether any problems are developing. Consider this a name server's medical checkup.

7.4.4 Common Event Log Messages

The Microsoft DNS Server logs events to the System Log. To view the events, you can either use the Event Viewer (which you start with Start Administrative Tools Event Viewer) or click on the Event Viewer folder for a given server in the DNS console's left pane. The DNS server logs to a special category called, appropriately enough, DNS Server. If you use the Event Viewer, make sure you're looking at the correct log messages by selecting DNS Server in the left pane. To save space, when we describe an event we won't show a screenshot of the complete event. Instead, we'll list just the description from the event detail. (Double-click an event to see its details.) We'll also list the Event ID in parentheses after the text of the event.

When the server starts up (either at boot time or because you restarted it) and is ready to answer queries, you'll see this event:

The DNS Server has started.  (ID 2)

For a healthy server, you should see this event after booting. If you stop the server manually, you'll see this event:

The DNS Server has shutdown.  (ID 3)

If a server is a secondary for a zone, it will notify you every time it performs a zone transfer:

A more recent version, version 2000120500 of zone movie.edu was found at DNS server 
at 192.249.249.3. Zone transfer is in progress.  (ID 6522)

The DNS server wrote version 2000120500 of zone movie.edu to file movie.edu.dns.   
(ID 3150)

You'll also see that last message on the primary when you make a change to a zone through the DNS console and select Action Update Server Data Files. After the server writes the updated file to disk, it logs that event.

If the primary is not authoritative for the zone—another error condition—you'll see this on the secondary:

Zone transfer request for secondary zone movie.edu refused by master server at 192.
249.249.3. Check the zone at the master server 192.249.249.3 to verify that zone 
transfer is enabled to this server. To do so, use the DNS console, and select master 
server 192.249.249.3 as the applicable server, then in secondary zone movie.edu 
Properties, view the settings on the Zone Transfers tab. Based on the settings you 
choose, make any configuration adjustments there (or possibly in the Name Servers 
tab) so that a zone transfer can be made to this server.  (ID 6525)

Unfortunately, if the name server simply can't reach the primary (e.g., if it has gone down), the DNS server never logs an error.

On the other hand, a server that's a primary for a zone will notify you when a secondary does a zone transfer:

The DNS server successfully completed transfer of version 3 of zone movie.edu to DNS 
server at 192.249.249.1.  (ID 6001)

If you're missing the cache file, cache.dns, or a zone datafile, the server will log a flurry of messages. A missing or empty cache file produces these events:

The DNS server could not open the file dns\cache.dns.  Check that the file exists in the 
%SystemRoot%\System32\Dns directory and that it contains valid data. The event data is 
the error code.  (ID 1000)

The DNS server could not find or open zone file dns\cache.dns.  in the %SystemRoot%\
System32\Dns directory.  Verify that the zone file is located in this directory and that 
it contains valid data.  (ID 1004)

The DNS server is not root authoritative and no root hints were specified in the cache.dns file. 
Where the server is not a root server, this file must specify root hints in the form of at
 least one name server (NS) resource record, indicating a root DNS server and a corresponding 
host (A) resource record for that root DNS server.  Otherwise, the DNS server will be 
unable to contact the root DNS server on startup and will be unable to answer queries for 
names outside of its own authoritative zones.  To correct this problem, use the DNS console 
to update the server root hints.  For more information, see the online Help.  (ID 707)

The DNS server does not have a cache or other database entry for root name servers. 
Either the root hints file, cache.dns, or Active Directory must have at least one name 
server (NS) resource record, indicating a root DNS server and a corresponding host (A) 
resource record for that root DNS server.  Otherwise, the DNS server will be unable to 
contact the root DNS server on startup and will be unable to answer queries for names 
outside of its own authoritative zones.  To correct this problem, use the DNS console to 
update the server root hints.  For more information, see the online Help.  (ID 706)

The somewhat cryptic message "The event data is the error code" makes more sense when viewing the message in Event Viewer. This message means there's a specific error code listed in the Data field at the bottom of the Event Properties window for this event.

A missing zone datafile, say movie.edu.dns, generates these events:

The DNS server could not open the file dns\movie.edu.dns.  Check that the file exists in the 
%SystemRoot%\System32\Dns directory and that it contains valid data. The event data is the
error code.  (ID 1000)

The DNS server could not find or open zone file dns\movie.edu.dns.  in the %SystemRoot%\
System32\Dns directory.  Verify that the zone file is located in this directory and that 
it contains valid data.  (ID 1004)

The server also logs a syntax error in a zone datafile. If you always make changes to your zones using the DNS console, you shouldn't see syntax errors. Editing by hand can get you into trouble, though. Here's what happens when the server encounters a syntax error (the exact error messages will vary based on the kind of syntax error):

The DNS server could not parse an unexpected token "terminator.movie.edu." in zone file 
movie.edu.dns at line 24.  Although the DNS server continues to load, ignoring this token, 
it is recommended that you either correct the token or remove the resource record from 
the zone file, which is located in the %SystemRoot%\System32\Dns directory.  (ID 1504)

The DNS server is ignoring an invalid resource record in zone file movie.edu.dns at line 24. 
See the previously logged event for a description of the error. 
Although the DNS server continues to load, ignoring this RR, it is recommended that you 
investigate the error associated with this record and either correct it or remove it from 
the zone file.  (ID 1508)

For a list of most of the events logged by the Microsoft DNS Server, see article 259302 in the Microsoft Knowledge Base. This article lists events for the Windows 2000 version of the DNS Server since a Windows 2003 list was not available when this book went to press. However, in our experience, many of the events are identical between the Windows 2000 and Windows Server 2003 versions of the DNS Server.

7.4.5 Understanding Name Server Statistics

You should periodically look over the statistics on some of your name servers. Name server statistics are viewed with the System Monitor. To start it, select Start Administrative Tools Performance. Make sure System Monitor is selected in the left pane, right-click in the right pane, and select Add Counters. Select DNS in the Performance object pull-down list. You'll see a list of all the server parameters that you can monitor in real time. A brief explanation of each parameter is available in the Windows online help system document entitled "Monitoring DNS server performance." To view this document, choose Start Help and type Monitoring DNS Server Performance in the search box and press Enter. Click the help topic button in the left pane and click on the document link when it appears.

Selecting all parameters is not useful—it produces too much information. To get an idea of the amount of memory being used by the server, choose Caching Memory and Database Node Memory. To see how busy the server is—that is, how many queries it is handling—look at Total Query Received/sec and Total Response Sent/sec. To select several parameters, hold down the Ctrl key while single-clicking. When you've selected all the ones you want, choose Add, then Close. Note that you have to save this list if you want to avoid selecting the list of parameters again. Select File Save As to produce a .msc file that you can use for subsequent monitoring sessions.