DNS synchronization

Hi, I’m trying to determine whether our DNS synchronization is behaving correctly or not. Here’s what we have

ns1
ns2,
ns3(ns4)
ns5
ns1, ns2, ns3, and ns5 are also hosting servers and so zones are authoritative on these systems. ns4 is clustered with ns3 so it should be identical to ns3.

ns1 and ns2 listen for updates from ns3(ns4)
ns2 listens for updates on ns1
ns3(ns4) listens for updates from ns1,ns2, and ns5

Questions:

  1. When a DNS server publishes changes, does it only publish changes for which it is the authority? Or does it publish changes it has received from other authoritative servers as well?

for example: if a change is made on ns3(ns4), ns1 will receive the update. Because ns1 publishes changes to ns2, will ns2 also receive the changes made on ns3(ns4)? or does ns2 need to receive the update directly from ns3(ns4)?

  1. Is there any risk to having servers receive the same update from more than one server?

Specifically, what I’m seeing that I think I shouldn’t be seeing is that a domain created on ns3(ns4) is not having DNS records propagated to ns2 even though I see the changes on ns1, and ns1 is setup as a publisher to ns2.

and separately, ns1, ns3, ns4, and ns5 provide the proper response when querying for a domain created on ns5, but ns2 does not.

Ns2 does however provide the proper response when queried for domains which it is authoritative, or domains for which ns1 is authoritative.

The above would have me thinking that each listener needs to receive changes directly from the authoritative server - except that a change made on ns5 and only published to itself and ns3 is also available on ns1.

Any insight to the above questions would be appreciated.

One of my initial premises was wrong. At this time I have no evidence to indicate that changes propagate down the chain. Can anyone confirm that any server that syncs with another server should be directly set to listen to that server?

Thanks.

[QUOTE=aos;28935]Hi, I’m trying to determine whether our DNS synchronization is behaving correctly or not. Here’s what we have

ns1
ns2,
ns3(ns4)
ns5
ns1, ns2, ns3, and ns5 are also hosting servers and so zones are authoritative on these systems. ns4 is clustered with ns3 so it should be identical to ns3.

ns1 and ns2 listen for updates from ns3(ns4)
ns2 listens for updates on ns1
ns3(ns4) listens for updates from ns1,ns2, and ns5

Questions:

  1. When a DNS server publishes changes, does it only publish changes for which it is the authority? Or does it publish changes it has received from other authoritative servers as well?

for example: if a change is made on ns3(ns4), ns1 will receive the update. Because ns1 publishes changes to ns2, will ns2 also receive the changes made on ns3(ns4)? or does ns2 need to receive the update directly from ns3(ns4)?

  1. Is there any risk to having servers receive the same update from more than one server?

Specifically, what I’m seeing that I think I shouldn’t be seeing is that a domain created on ns3(ns4) is not having DNS records propagated to ns2 even though I see the changes on ns1, and ns1 is setup as a publisher to ns2.

and separately, ns1, ns3, ns4, and ns5 provide the proper response when querying for a domain created on ns5, but ns2 does not.

Ns2 does however provide the proper response when queried for domains which it is authoritative, or domains for which ns1 is authoritative.

The above would have me thinking that each listener needs to receive changes directly from the authoritative server - except that a change made on ns5 and only published to itself and ns3 is also available on ns1.

Any insight to the above questions would be appreciated.[/QUOTE]

Hi aos

Welcome to IW forums

I have read your posts but it’s been a long day and I’m trying to understand your post

How are you querying the DNS

I always thought the DNS would propagate to the listener, even if setup in chain. However, you will not see DNS for domains not held on the listener, hence why j asked my question

I will have to reread your post to have better understanding of your question as it is quiet long

I hope that helps

Many thanks

John

Hi John,

$dig domain @server

This is after sufficient time has after verifying that sync has taken place between the servers involved.

Essentially, you get the question. Are DNS records supposed to be able to propagate in a chain?

Thank you.

[QUOTE=d2d4j;28937]Hi aos

Welcome to IW forums

I have read your posts but it’s been a long day and I’m trying to understand your post

How are you querying the DNS

I always thought the DNS would propagate to the listener, even if setup in chain. However, you will not see DNS for domains not held on the listener, hence why j asked my question

I will have to reread your post to have better understanding of your question as it is quiet long

I hope that helps

Many thanks

John[/QUOTE]

Hi aos
Many thanks, and I think you raise a valid point, which I will have to think about a little longer.
My initial tests this morning though, show DNS working as expected (see below), and I believe I understood you correctly, as follows:
NS1 is main DNS IW server (publisher) to NS2
NS2 is a DNS (listener) from NS1
NS3 is a DNS (listener) from NS2
YOur question is
if a domain zones was added to NS2, would NS3 be aware of domain zones from NS1 and NS2
My test showed this was true, as in my test I did the following:
NS1 (production, main IW server) (publisher) to NS4
NS4 is a DNS (listener) from NS1
NS1 (test, main IW server) is a DNS (listener) from NS4
a new domain zone was added to NS4, called dnstest.url, time allowed for sync of DNS, and a nslookup perform on NS4 and NS1 (test)
I hope I have understood correctly, but sorry if not.
Many thanks
John
Microsoft Windows [Version 5.2.3790]
© Copyright 1985-2003 Microsoft Corp.
C:\Documents and Settings\Administrator>nslookup
Default Server: hidden.co.uk
Address: nnn.nnn.nnn.nnn
> server ns1.test.co.uk (THIS IS THE LISTENER)
Default Server: ns1.nnn.co.uk
Address: nnn.nnn.nnn.nnn
> nslookup nnn.co.uk (this domain zone is held on ns1 test)
Server: nnn.co.uk
Address: nnn.nnn.nnn.nnn
> server ns4.production.co.uk (THIS IS THE PUBLISHER)
Default Server: ns4.nnnnnnn.co.uk
Address: nnn.nnn.nnn.nnn
> nslookup dnstest.url
Server: dnstest.url
Address: 5.5.5.5
> nslookup nnnnnnn.co.uk (this domain is held on NS1 production)
Server: nnnnnnn.co.uk
Address: nnn.nnn.nnn.nnn
> server ns1.test.co.uk (THIS IS THE LISTENER)
Default Server: ns1.nnn.co.uk
Address: nnn.nnn.nnn.nnn
> nslookup dnstest.url
Server: dnstest.url
Address: 5.5.5.5
>
Please note
NS4 is DNS only and receives all zone updates from main IW server (production server)
NS1 is a test server
I set DNS as follows:
NS4 publishes DNS zones to NS1
NS1 listens for DNS zones from NS4