18.11. Using BIND for DNS
Problem
You’ve decided that you do not want to use Microsoft DNS for Active Directory and instead prefer to use BIND.
Solution
The two main requirements for supporting Active Directory DNS are SRV records and Dynamic DNS support. The first version of BIND to support SRV records was 8.2.2 patch 7. Hopefully you are running a much more recent version since that was released in 2000. You technically don’t have to use DDNS with Active Directory DNS records, but if you don’t, you end up doing a lot of work to manually maintain the Active Directory-related resource records.
Here is an example BIND 8 configuration to support the ad.rallencorp.com domain:
Options { directory "/etc/namedb"; }; Zone "ad.rallencorp.com" IN { type master; file "db.ad.rallencorp.com"; allow-update { dc1.; dc2.; dc3.; }; check-names ignore; };
The directory
directive specifies where the zone files are stored.
The type
should be master
,
and the file
directive is the
name of the file to store the contents of the zone in. The
allow-
update directive indicates which servers
(either by name or IP address) can dynamically update the zone.
Finally, the check-names
ignore
directive tells BIND not to be restrictive
about the names used in resource records. Without this setting, BIND
would fail to respond to queries for records containing underscores
used by Active Directory.
The BIND 9 configuration for the same zone would look exactly the
same, except the check-names ignore
line is not necessary. By ...
Get Active Directory Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.