Windows Server 2003 : Implementing a DNS Infrastructure - Creating Zone Delegations

Delegating Zones

To delegate a zone means to assign authority over portions of your DNS namespace to subdomains within this namespace. A zone delegation occurs when the responsibility for the resource records of a subdomain is passed from the owner of the parent domain to the owner of the subdomain. For example, in Figure 1 , the management of the microsoft.com domain is delegated across two zones: microsoft.com and mydomain.microsoft.com. In the example, the administrator of the mydomain.microsoft.com zone controls the resource records for that subdomain.

When to Delegate Zones

You should consider delegating a zone within your network whenever any of the following conditions are present:

• You need to delegate management of a DNS domain to a branch or department within your organization.

• You need to distribute the load of maintaining one large DNS database among multiple name servers to improve name resolution performance and fault tolerance.

• You need hosts and host names to be structured according to branch or departmental affiliation within your organization.

When choosing how to structure zones, you should use a plan that reflects the structure of your organization.

How Delegations Work

For a delegation to be implemented, the parent zone must contain both an A resource record and an NS resource record pointing to the authoritative server of the newly delegated domain. These records are necessary both to transfer authority to the new name servers and to provide referrals to clients performing iterative queries. In this section, you walk through an example of delegating a subdomain to a new zone.

In Figure 2 , an authoritative DNS server computer for the newly delegated example.microsoft.com subdomain is given a name based on a derivative subdomain included in the new zone (ns1.us.example.microsoft.com). To make this server known to others outside the newly delegated zone, two resource records are needed in the microsoft.com zone to complete delegation to the new zone. These records are automatically created when you run the New Delegation Wizard in the DNS console.

These records include the following:

• An NS record (also known as a delegation record ) to create the actual delegation. This record is used to advertise to querying clients that the computer named ns1.us.example.microsoft.com is an authoritative server for the delegated subdomain.

• An A resource record (also known as a glue record ) to resolve the name of the server specified in the NS record to its IP address. Glue records are necessary when the name server authoritative for the delegated zone is also a member of the delegated domain. The process of resolving the host name in this record to the delegated DNS server in the NS record is sometimes referred to as glue chasing .

Suppose an external DNS server (acting as a client) wants to resolve the FQDN box.example.microsoft.com. When this computer queries a name server authoritative for the microsoft.com domain, this name server responds with the glue record, informing the querying client that a name server authoritative for the example.microsoft.com domain is ns1.us.example.microsoft.com, with an IP address of 192.168.1.5. The querying computer then performs another iterative query to the name server ns1.us.example.microsoft.com. This latter name server finally responds to the querying computer with the IP address of the host box.example.microsoft.com, for which the name server is authoritative.

Note

Creating a Zone Delegation

To create a zone delegation, first create the domain to be delegated on the server that will be hosting the delegated zone. Then run the New Delegation Wizard on the server hosting the parent zone by right-clicking the parent zone node in the DNS console and selecting New Delegation.

To complete the New Delegation Wizard, you need to specify the name of the delegated subdomain and the name of at least one name server that will be authoritative for the new zone. After you run the wizard, a node appears in the DNS console tree representing the newly delegated subdomain, and this node contains the delegation (NS) resource record of the authoritative server you have just specified. The glue record appears in the zone data but not in the DNS console.

To create a zone delegation, complete the following steps:

Practice: Creating a Zone Delegation

In this practice, you create a new zone on Computer2 that becomes a delegated sub-domain of the domain1.local domain. You then create a delegation on Computer1 that is linked to this new zone on Computer2. Finally, you verify the new configuration.

Exercise 1: Creating a Zone to Be Delegated

In this exercise, you create a new zone on Computer2.

Exercise 2: Adding Host (A) Resource Records to the Zone

In this exercise, you add records to the new zone that you will later use to verify the zone delegation.

Exercise 3: Creating a Delegation

In this exercise, you create a delegation on Computer1 that connects to the zone sub.domain1.local on Computer2.

Exercise 4: Testing the Configuration

In this exercise, you ping the hosts in the newly delegated domain. You perform this exercise on Computer1, which uses the local DNS server for name resolution.